Report - a5e2765ca4ee…8c19cf72e9

Suspicious HighFILE

Quota 46

First seen: 2026-11-04T04:23:42Z
Last seen: 2026-11-08T03:16:19Z

THREAT SIGNALMedium-low Read alongside the verdict

CONFIDENCE58%VirusSign analysis

FAMILYbashdownloader

RELATED INDICATORS20Connections in this report

ANALYSISSuspiciousFresh

Indicator overview

INDICATOR PROFILE

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

SHA256: a5e2765ca4eeed62df2fb59e61f6b833b27b7424adda1eff7d45e48c19cf72e9
SHA1: 8efe90c50a47c8ecedbd26d60740380ecd7ef7ca
MD5: 9b0f045c06c88ed96456515698165bf2
File type: shell
MIME: text/plain
File size: 2542
TLSH: T1F651C5F4BAB1CD72704DD8F7B39E8878599F8DAFA4F4B9F445464C12260891478CCAB1
SSDEEP: 48:w6GpGSpGSpPiPupiupampWipiup4cpgEpGSpBEBopRwRUp69r2dyw:0vv5ou3nH3nn7XH6Ugrwyw
First seen: 2026-11-04T04:23:42Z
Last seen: 2026-11-08T03:16:19Z

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (5%).

Confidence signal

VirusSign confidence is elevated at 58%. Use it as supporting evidence together with detections, family and relationship context.

Analysis signals

OBSERVED

Engine detections5%

VirusSign confidence58%

Relationship context20 visible

Threat classificationbash

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

226c1bd84fc22c4c6568b03494ce9c142dc34e4601c31375d0eaac2fa330bca0

24% high elf 43176 bytes drops

Filename c95d236fb0d70d5aed91e88fa761218394c03833f71e2ab444f10784ee11b680 Family mirai Type backdoor File type elf MIME application/x-elf

e243145ecdd3587b02cc4b37964c03353f0bc06cf8b36893c602e00090feddb1

33% high elf 43177 bytes drops

Filename 1f7267255031114267ea5ebe992573665593cf73adace6041163bcc04f79c11f Family mirai Type trojan File type elf MIME application/x-elf

d918c0a78798098f0a74fb0909e9957dff5c4468bd2055e43fbd938ea03ed03d

43% high elf 109783 bytes drops

Filename d7f8f73f9d39b54121d30174b2419ab79ad53babc900701cea92e31a3936e7df Family mirai Type backdoor File type elf MIME application/x-elf

1f0d12203ce501710d4e0af856b2da3cb2d06eea7d14c3f4e924118faa44d0df

41% high elf 60553 bytes drops

Filename hdts6.exe Family mirai Type trojan File type elf MIME application/x-elf

c9e51a1306bf1323f450c851cdcb7c4bc7851ef0f5337a905ac4c89b7f366e3d

24% high elf 40280 bytes drops

Filename 1k5h51va.exe Family mirai Type backdoor File type elf MIME application/x-elf

Related IPs

Network IPs associated with this indicator.

5shown

160.250.5.200

15% medium VN communicates

CIDR 160.250.4.0/23 Network 160.250.4.0-160.250.5.255 First seen 2026-08-20T04:27:44Z Last seen 2026-11-10T17:45:28Z

180.93.193.100

29% high VN communicates

CIDR 180.93.192.0/18 Network 180.93.0.0-180.93.255.255 First seen 2026-10-26T22:48:29Z Last seen 2026-11-08T03:16:24Z

23.61.255.137

0% US communicates

CIDR 23.61.248.0/21 Network 23.32.0.0-23.67.255.255 First seen 2023-10-10T20:18:51Z Last seen 2026-11-09T10:01:47Z

23.222.245.13

US communicates

CIDR 23.222.244.0/22 Network 23.192.0.0-23.223.255.255 First seen 2023-10-29T08:42:21Z Last seen 2026-11-10T21:51:15Z

23.222.244.213

0% US communicates

CIDR 23.222.244.0/22 Network 23.192.0.0-23.223.255.255 First seen 2023-10-02T04:29:30Z Last seen 2026-11-10T22:00:46Z

Related domains

Domains associated with this indicator.

5shown

bocbathode.devs.surf

33% high .surf communicates

Root devs.surf TLD surf Subdomain bocbathode First seen 2026-01-12T09:20:45Z Last seen 2026-11-08T03:16:24Z

e4805.dsca.akamaiedge.net

0% .net communicates

Root akamaiedge.net TLD net Subdomain e4805.dsca First seen 2023-09-29T04:59:22Z Last seen 2026-11-10T22:17:20Z

e5977.dsce9.akamaiedge.net

0% .net communicates

Root akamaiedge.net TLD net Subdomain e5977.dsce9 First seen 2023-09-28T22:03:10Z Last seen 2026-11-10T22:17:20Z

s.mzstatic.com

0% .com communicates

Root mzstatic.com TLD com Subdomain s First seen 2023-09-29T01:46:07Z Last seen 2026-11-10T22:17:20Z

api.snapcraft.io

0% .io communicates

Root snapcraft.io TLD io Subdomain api First seen 2023-10-01T01:10:27Z Last seen 2026-11-10T22:17:20Z

Related URLs

URLs associated with this indicator.

5shown

http://180.93.193.100/sh4

35% medium communicates

HTTP status 200 Content length 75232 Content SHA256 af3ddecb85a7b8e63c5ada278c5a746e1908fcc44efc9b017159afdde8736081 First seen 2026-10-31T22:47:40Z Last seen 2026-11-08T03:16:24Z

http://180.93.193.100/ppc

35% medium communicates

HTTP status 200 Content length 83524 Content SHA256 3c200719ab2f52e785228ca28626df9d2b046c86defaa09d5a5e9697019c4b30 First seen 2026-11-01T22:13:02Z Last seen 2026-11-08T03:16:24Z

http://180.93.193.100/mpsl32

32% high communicates

HTTP status 404 Content length 276 Content SHA256 dd9af08635f83703ddaf3b61d5cbe5a9c540191efe91de254db206a7db0ecbea First seen 2026-10-31T22:26:29Z Last seen 2026-11-08T03:16:20Z

http://180.93.193.100/mpsl

35% medium communicates

HTTP status 200 Content length 109696 Content SHA256 dd3e4264932e195f5c04d31927692e1b4189d34443ca090c054f1913e635faca First seen 2026-10-31T18:24:52Z Last seen 2026-11-08T03:16:24Z

http://180.93.193.100/m68k

32% medium communicates

HTTP status 200 Content length 91228 Content SHA256 c3d5dcf405f962d30736f8709b050612999579ba8b2de5bc887d94cb97b723a5 First seen 2026-11-01T11:14:59Z Last seen 2026-11-08T03:16:24Z

Analysis details

Severity: highdownloaderprocess-renamedebug-checkshellservice-scanself-delete

Freshness: Fresh · Last seen 2 days ago.

Detection rate: 5%
Threat type: downloader
Family: bash
Confidence: 58%
detection: 5 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: a5e2765ca4eeed62df2fb59e61f6b833b27b7424adda1eff7d45e48c19cf72e9
SHA1: 8efe90c50a47c8ecedbd26d60740380ecd7ef7ca
MD5: 9b0f045c06c88ed96456515698165bf2
File type: shell
MIME: text/plain
File size: 2542
TLSH: T1F651C5F4BAB1CD72704DD8F7B39E8878599F8DAFA4F4B9F445464C12260891478CCAB1
SSDEEP: 48:w6GpGSpGSpPiPupiupampWipiup4cpgEpGSpBEBopRwRUp69r2dyw:0vv5ou3nH3nn7XH6Ugrwyw
First seen: 2026-11-04T04:23:42Z
Last seen: 2026-11-08T03:16:19Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (5%).

Confidence signal

VirusSign confidence is elevated at 58%. Use it as supporting evidence together with detections, family and relationship context.

Threat context

Classification includes type downloader and family bash.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2023-09-28 to 2026-11-04. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

Engine detections 5%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

VirusSign confidence 58%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification bash

Classification context: type downloader, family bash.

Intelligence freshness Fresh

Last seen 2 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

File type: shell
MIME: text/plain
Size: 2542

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkself-deleteservice-scanprocess-rename

View details · 5 shown

Classification label
Connects to IPs without corresponding DNS lookups
Connects to many ports of the same IP (likely port scanning)
Contains symbols with names commonly found in malware
Creates hidden files and/or directories

5 shown

View MITRE ATT&CK details · 5 shown

T1564.001 — Creates hidden files, links and/or directories
Tactics: TA0005
T1070.004 — Deletes files from disk
Tactics: TA0005
T1571 — Detected TCP or UDP traffic on non-standard ports
Tactics: TA0011
T1071 · T1095 · T1105 — Downloads files from webservers via HTTP
Tactics: TA0011
T1003 — Enumerates processes within the "proc" file system
Tactics: TA0006

5 shown

View MBC details · 5 shown

Command and Control
Objectives: OB0004
Communication
Objectives: OC0006
Defense Evasion
Objectives: OB0006
C0047 — Delete File
Objectives: OC0001
B0033 — Denial of Service
Objectives: OB0008

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 80, 45678

5+ outbound connections observed
1 domains, 5+ IPs, 5+ URLs
Common ports: 443, 80, 45678, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: 180.93.193.100
URL: http://180.93.193.100/x86_64
Protocol: HTTP

Domain: 180.93.193.100
URL: http://180.93.193.100/x86
Protocol: HTTP

Domain: 180.93.193.100
URL: http://180.93.193.100/spc
Protocol: HTTP

Domain: 180.93.193.100
URL: http://180.93.193.100/sh4
Protocol: HTTP

Domain: 180.93.193.100
URL: http://180.93.193.100/ppc
Protocol: HTTP

5 shown

DNS request activity5

A5+ response IPs

5 DNS requests observed
5 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: bocbathode.devs.surf
Type: A
Answers: 160.250.5.200
Response: NOERROR

Query: s.mzstatic.com
Type: A
Answers: 17.253.7.139, 17.253.7.137
Response: NOERROR

Query: e5977.dsce9.akamaiedge.net
Type: A
Answers: 23.222.245.13
Response: NOERROR

Query: e4805.dsca.akamaiedge.net

Query: api.snapcraft.io
Type: A
Answers: 185.125.188.57, 185.125.188.60, 185.125.188.59, 185.125.188.58, 185.125.188.55, 185.125.188.54
Response: NOERROR

C2 candidates4

TCP, DNS, HTTPports 45678, 53, 80

4 C2 candidate communications
2 domains, 2 IPs
Common ports: 45678, 53, 80
Protocols: TCP, DNS, HTTP

View details · 4 shown

IP: 160.250.5.200
Domain: bocbathode.devs.surf
Port: 53
Protocol: DNS

IP: 160.250.5.200
Port: 45678
Protocol: TCP

Domain: 180.93.193.100
Protocol: HTTP

IP: 180.93.193.100
Port: 80
Protocol: TCP

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check