Report - 116.138.188.74:57241/bin.sh

Report Overview

Visitedpublic

2025-07-10 01:58:02

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
116.138.188.74	unknown	unknown	No data	No data	411 B	138 kB	116.138.188.74

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-07-10 01:57:27	high	116.138.188.74	Client IP	ET POLICY Executable and linking format (ELF) file download

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-07-10	medium	116.138.188.74:57241/bin.sh	Detects a suspicious ELF binary with UPX compression
2025-07-10	medium	116.138.188.74:57241/bin.sh	Linux.Packer.Patched_UPX

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-07-10	medium	116.138.188.74	Sinkholed

ThreatFox

No alerts detected

File detected

URL

116.138.188.74:57241/bin.sh

IP / ASN

116.138.188.74

#4837 CHINA UNICOM China169 Backbone

File Overview

File TypeELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV)

Size138 kB (137480 bytes)

MD53849f30b51a5c49e8d1546960cc206c7

SHA161c74136534b826059c63221a2373dc0613a47b7

SHA256f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects a suspicious ELF binary with UPX compression
Elastic Security YARA Rules	malware	Linux.Packer.Patched_UPX
VirusTotal	malicious	VirusTotal - Scan result 48/64

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET 116.138.188.74:57241/bin.sh

116.138.188.74

200 OK

138 kB

URL

116.138.188.74:57241/bin.sh

IP / ASN

116.138.188.74

#4837 CHINA UNICOM China169 Backbone

Requested byN/A

Resource Info

File typeELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV)

First Seen2023-05-05

Last Seen2025-07-15

Times Seen25402

Size138 kB (137480 bytes)

MD53849f30b51a5c49e8d1546960cc206c7

SHA161c74136534b826059c63221a2373dc0613a47b7

SHA256f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects a suspicious ELF binary with UPX compression
Elastic Security YARA Rules	malware	Linux.Packer.Patched_UPX
Quad9 DNS	malicious	Sinkholed
VirusTotal	malicious	VirusTotal - Scan result 48/64

HTTP Headers

GET /bin.sh HTTP/1.1
Host: 116.138.188.74:57241
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Length: 137480
Connection: close
Content-Type: application/zip