Report - fb80e4f5557d…f32feaaf24

Malicious HighFILE

Quota 46

First seen: 2026-11-08T01:26:10Z
Last seen: 2026-11-08T01:45:35Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYvshelltrojan

RELATED INDICATORS13Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: fb80e4f5557da56d748af48a5ee4e56e07c7decc4322611570937ff32feaaf24
SHA1: a4f0416c89320a3967a57cd7d97725e318125e40
MD5: 3a75f25cfc75349268e2f49a5e4cb75e
File type: elf
MIME: application/x-elf
File size: 9848
TLSH: T1CD124047A2D1CE7BC8E813384467122472BBD47ADFA29713050C65B66E923DC1E69F8A
SSDEEP: 96:GjOTpJ4WHbHf56lTTej6TNJ9V5Nddfs2oYJYoBSf7meaamBFBp8hBdZvZ4:G6z4WT2TTfTpVhdfs2So8f2Tr8h3
First seen: 2026-11-08T01:26:10Z
Last seen: 2026-11-08T01:45:35Z

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 43%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections43%

VirusSign confidence100%

Relationship context13 visible

Threat classificationvshell

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

13 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

26aeeeceb5a4f1d9bd4df76476eb23c2bb44c06722a0027de47c1d8ee62aaefa

36% high elf 8007680 bytes drops

Filename memfd_a (deleted) Family vshell Type trojan File type elf MIME application/x-elf

6db118a0d9623cab3be1adfce69bf0e2d03a45a438ad5507a7c30759251bee3e

241 bytes contains

Filename .shstrtab MIME application/octet-stream Size 241 SHA1 5c542046e2fa8fda89433cbeb924678bed86b5b0 First seen 2026-04-28T01:00:56Z

c70fbcfeb5350db4d207149d87960e2f23fb322c20552a9cac4eb6b3e95e5e73

0% text 32 bytes contains

Filename _4 File type text MIME text/plain Size 32 SHA1 447eeb9da047efc5f7eb3192776c9ea489e36e07

66e6f54550612182b4ad78f30b140dd08318b968db3878de2db65fef87dc04d7

0% text 9 bytes contains

Filename .fini_14 File type text MIME text/plain Size 9 SHA1 fa7de3c1bbc31c0cfd7a16048b53b1bce8d2c590

9097c98ea70f6f3b01d50145eb72bf55ad1f4e9713bccf27bd6405d6254eed00

0% text 28 bytes contains

Filename .interp_2 File type text MIME text/plain Size 28 SHA1 4dfcf93efb863b86a864e5949997550f1e31bd64

Related IPs

Network IPs associated with this indicator.

5shown

206.206.76.110

15% medium SG communicates

CIDR 206.206.76.0/22 Network 206.206.64.0-206.206.127.255 First seen 2024-06-04T19:59:47Z Last seen 2026-11-09T16:46:42Z

185.125.188.60

0% GB communicates

CIDR 185.125.188.0/22 Network 185.125.188.0-185.125.191.255 First seen 2023-12-12T04:33:57Z Last seen 2026-11-11T01:36:23Z

185.125.188.55

0% GB communicates

CIDR 185.125.188.0/22 Network 185.125.188.0-185.125.191.255 First seen 2023-10-01T07:36:54Z Last seen 2026-11-11T01:36:23Z

169.254.169.254

0% communicates

First seen 2021-02-13T15:17:29Z Last seen 2026-11-11T01:16:01Z

185.125.188.59

0% GB communicates

CIDR 185.125.188.0/22 Network 185.125.188.0-185.125.191.255 First seen 2023-09-30T18:03:12Z Last seen 2026-11-11T01:36:23Z

Related domains

Domains associated with this indicator.

1shown

api.snapcraft.io

0% .io communicates

Root snapcraft.io TLD io Subdomain api First seen 2023-10-01T01:10:27Z Last seen 2026-11-11T01:36:23Z

Related URLs

URLs associated with this indicator.

2shown

http://206.206.76.110:2095/?…

19% medium communicates

HTTP status 200 Content length 8007680 Content SHA256 4a12ea42d162b60933fa5e0221cbc6a4b11438b6e824542fc9806c197465baf4 First seen 2026-11-07T19:44:02Z Last seen 2026-11-08T01:45:38Z

http://206.206.76.110:2095/

17% medium communicates

HTTP status 200 Content length 637 Content SHA256 af44db26be11baa7878941cc1d95ccf043170236d6610ad24828affb44c873a6 First seen 2025-11-07T07:09:21Z Last seen 2026-11-08T01:45:38Z

Analysis details

Severity: hightrojanelf64bitmalwaredebug-checkdownloader

Freshness: Fresh · Last seen 2 days ago.

Detection rate: 43%
Threat type: trojan
Family: vshell
Confidence: 100%
detection: 43 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: fb80e4f5557da56d748af48a5ee4e56e07c7decc4322611570937ff32feaaf24
SHA1: a4f0416c89320a3967a57cd7d97725e318125e40
MD5: 3a75f25cfc75349268e2f49a5e4cb75e
File type: elf
MIME: application/x-elf
File size: 9848
TLSH: T1CD124047A2D1CE7BC8E813384467122472BBD47ADFA29713050C65B66E923DC1E69F8A
SSDEEP: 96:GjOTpJ4WHbHf56lTTej6TNJ9V5Nddfs2oYJYoBSf7meaamBFBp8hBdZvZ4:G6z4WT2TTfTpVhdfs2So8f2Tr8h3
First seen: 2026-11-08T01:26:10Z
Last seen: 2026-11-08T01:45:35Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 43%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family vshell.

Relationship context

13 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

14 timestamped observations are arranged from 2011-11-03 to 2026-11-08. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 43%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 13 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification vshell

Classification context: type trojan, family vshell.

Intelligence freshness Fresh

Last seen 2 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

File type: elf
MIME: application/x-elf
Size: 9848

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-check

View details · 5 shown

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Classification label
Connects to IPs without corresponding DNS lookups
Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing)
Creates hidden files and/or directories

5 shown

View MITRE ATT&CK details · 5 shown

T1497 — Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing)
Tactics: TA0005 · TA0007
T1564.001 — Creates hidden files, links and/or directories
Tactics: TA0005
T1571 — Detected TCP or UDP traffic on non-standard ports
Tactics: TA0011
T1071 · T1095 · T1105 — Downloads files from webservers via HTTP
Tactics: TA0011
T1071 — HTTP traffic contains suspicious features which may be indicative of malware related traffic
Tactics: TA0011

5 shown

View MBC details · 5 shown

Command and Control
Objectives: OB0004
Communication
Objectives: OC0006
B0033 — Denial of Service
Objectives: OB0008
E1027.m02 — Encoding-Standard Algorithm
Objectives: OB0002 · OB0006
C0002 — HTTP Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCPports 443, 2095

5+ outbound connections observed
1 domains, 4 IPs, 2 URLs
Common ports: 443, 2095
Protocols: HTTP, TCP

View details · 5 shown

Domain: 206.206.76.110
URL: http://206.206.76.110:2095/?a=l64&h=206.206.76.110&t=ws_&p=2095
Protocol: HTTP

Domain: 206.206.76.110
URL: http://206.206.76.110:2095/
Protocol: HTTP

IP: 206.206.76.110
Port: 2095
Protocol: TCP

IP: 185.125.188.57
Port: 443
Protocol: TCP

IP: 185.125.188.54
Port: 443
Protocol: TCP

5 shown

DNS request activity1

A5+ response IPs

1 DNS requests observed
1 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 1 shown

Query: api.snapcraft.io
Type: A
Answers: 185.125.188.57, 185.125.188.60, 185.125.188.59, 185.125.188.58, 185.125.188.55, 185.125.188.54
Response: NOERROR

C2 candidates2

HTTP, TCPports 2095

2 C2 candidate communications
1 domains, 1 IPs
Common ports: 2095
Protocols: HTTP, TCP

View details · 2 shown

IP: 206.206.76.110
Port: 2095
Protocol: TCP

Domain: 206.206.76.110
Protocol: HTTP

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check