MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0467c530218973604d07d0247e6a64488c82471ab378bba773ac3250df5bbcb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	0467c530218973604d07d0247e6a64488c82471ab378bba773ac3250df5bbcb9
SHA3-384 hash:	6bc9571f42898d595851e5fef109c94e13e266f041b290a9d2a4e0d1531777746171c220336a2219be5ec5ce9f3ac95e
SHA1 hash:	5001501ff32b7b497265406d6faeef061973e540
MD5 hash:	e537e09e5a213bf8566c6ea7bfe574a4
humanhash:	crazy-massachusetts-mars-eighteen
File name:	aarch64
Download:	download sample
File size:	509'896 bytes
First seen:	2025-07-04 11:28:46 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP
TLSH	T1E2B41228EE4E38C1F3D1E378DA0A4BB2B05B79D0D166C1B2BA41E25D95EDDDEC5D0212
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6867bb13900df8e7f8669ca2linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates directories

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

exploit gcc

Link:

https://www.filescan.io/uploads/6867bb199db85bde254a958b/reports/a06faec5-66ce-43ad-832a-df1b1fbc4607/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

false

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/0467c530218973604d07d0247e6a64488c82471ab378bba773ac3250df5bbcb9

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 37.2.166.222:6881
type: 188.42.55.92:6881
type: 91.225.20.2:6881
type: 185.203.236.211:6881
type: 217.112.9.178:6881
type: 24.65.23.135:6881
type: 208.90.215.40:6881
type: 213.164.195.159:6881
type: 195.138.64.18:6881
type: 192.186.96.202:6881
type: 95.78.153.142:6881
type: 174.100.151.164:6881
type: 98.165.218.142:6881
type: 122.193.222.2:6881
type: 50.100.152.143:6881
type: 184.22.158.175:6881
type: 46.121.175.11:6881
type: 18.191.2.28:6881
type: 105.109.1.128:6881
type: 170.39.224.79:6881
type: 107.181.234.235:6881
type: 66.96.192.191:6881
type: 121.6.125.193:6881
type: 142.171.125.191:6881
type: 79.202.53.133:6881
type: 18.221.7.72:6881
type: 18.223.137.220:6881
type: 178.162.174.43:28004
type: 178.162.174.149:28001
type: 178.162.173.231:28001
type: 135.181.238.57:50000
type: 135.181.227.244:50000
type: 37.27.117.180:50000
type: 65.21.129.62:50000
type: 37.27.103.248:50000
type: 65.21.125.189:50000
type: 65.21.125.166:50000
type: 37.27.119.253:50000
type: 65.109.92.158:50000
type: 65.21.128.240:50000
type: 135.181.238.58:50000
type: 37.27.120.54:50000
type: 37.27.117.49:50000
type: 37.27.104.55:50000
type: 37.27.119.242:50000
type: 176.9.30.236:50000
type: 37.27.103.252:50000
type: 37.27.103.250:50000
type: 130.239.18.158:8524
type: 178.162.174.222:28014
type: 130.239.18.158:8515
type: 185.149.91.171:51010
type: 54.211.14.111:20871
type: 45.131.79.73:64008
type: 188.165.198.24:57621
type: 130.239.18.158:8513
type: 144.76.175.153:55363
type: 178.162.173.172:28009
type: 178.162.174.102:28009
type: 95.168.162.161:42670
type: 137.74.95.13:49999
type: 178.162.174.45:28015
type: 93.89.141.246:51413
type: 138.199.27.226:51413
type: 5.39.95.146:51413
type: 188.166.106.8:51413
type: 37.187.124.4:51413
type: 183.138.243.87:51413
type: 163.172.98.175:51413
type: 108.240.47.213:51413
type: 188.190.231.147:51413
type: 5.14.80.173:51413
type: 46.64.52.138:51413
type: 78.145.68.109:51413
type: 203.214.113.31:51413
type: 221.12.76.194:51413
type: 35.134.100.122:51413
type: 82.209.203.102:51413
type: 178.162.173.91:28003
type: 178.162.174.178:28003
type: 178.162.173.105:28003
type: 45.203.206.46:6880
type: 45.203.206.54:6880
type: 3.17.7.18:6880
type: 183.97.84.214:65339
type: 185.203.56.68:62927
type: 95.211.210.153:28010
type: 185.203.56.7:63571
type: 5.79.67.23:32491
type: 185.132.179.9:6885
type: 222.10.117.245:19386
type: 178.162.173.32:28000
type: 208.72.84.204:49162
type: 169.150.223.205:14409
type: 112.171.245.175:41144
type: 51.159.14.182:33893
type: 111.253.198.125:13113
type: 37.27.113.233:34177
type: 85.30.139.25:59792
type: 181.94.224.188:43326
type: 185.203.56.51:22201
type: 211.196.181.33:33447
type: 5.39.85.22:58850
type: 175.215.206.208:27942
type: 47.190.127.150:53573
type: 45.44.17.152:26745
type: 138.255.137.233:2289
type: 45.15.18.56:53609
type: 103.254.81.44:42188
type: 144.76.175.153:33582
type: 60.98.156.10:10254
type: 119.237.158.198:38049
type: 142.114.222.126:36116
type: 185.193.225.141:1100
type: 73.243.38.63:6889
type: 80.13.129.178:6889
type: 141.11.159.210:55784
type: 168.119.236.218:8999
type: 46.232.211.102:58140
type: 46.232.211.102:64113
type: 198.46.160.130:51444
type: 60.135.209.234:24370
type: 125.229.51.90:7484
type: 193.32.23.0:57390
type: 181.91.84.91:8022
type: 176.31.183.108:58607
type: 88.22.94.175:21356
type: 49.175.200.221:24774
type: 86.30.12.210:6882
type: 139.28.232.16:6882
type: 185.183.35.248:6882
type: 31.209.53.167:6293
type: 87.139.104.127:53325
type: 74.214.255.24:1042
type: 112.161.242.192:33020
type: 14.34.227.194:33240
type: 86.49.250.219:65249
type: 185.6.234.17:21611
type: 80.192.91.63:31005
type: 109.150.62.237:54325
type: 176.60.198.228:49001
type: 186.156.208.72:48076
type: 92.180.8.226:52759
type: 186.10.186.116:50841
type: 76.171.210.209:49516
type: 84.54.70.104:61246
type: 188.165.231.168:51854
type: 58.160.92.15:52176
type: 72.21.17.19:64599
type: 49.204.239.145:12070
type: 139.216.203.67:12282
type: 185.148.0.70:15324
type: 189.28.70.197:51213
type: 175.33.125.156:48190
type: 188.165.244.171:51479
type: 185.145.245.127:8662
type: 185.215.167.200:60674
type: 31.52.162.141:8644
type: 54.39.52.64:40452
type: 167.172.226.132:6060
type: 78.142.231.133:6767
type: 195.154.176.26:8645
type: 95.211.218.207:28018
type: 84.54.70.104:48346
type: 84.15.181.108:52556
type: 107.173.149.140:6339
type: 66.70.178.54:24996

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8149df4c-ea48-48d3-ace5-999a1b70b739

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/3dbd9a39-ed4e-436e-a663-5bf4cf55b610

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/0467c530218973604d07d0247e6a64488c82471ab378bba773ac3250df5bbcb9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0467c530218973604d07d0247e6a64488c82471ab378bba773ac3250df5bbcb9/

Verdict:

Malicious

Threat:

trojan.drop

Link:

https://tip.neiki.dev/file/0467c530218973604d07d0247e6a64488c82471ab378bba773ac3250df5bbcb9

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-07-04 11:29:23 UTC

File Type:

ELF64 Little (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=art4kmbbrfzwatih2ash42tejcgiery2wn4lxj3tvqzfbx23xs4q._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250704-nlqy3ask14/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/107af607-2998-4c7e-9e00-1f56a5e7c8f8

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0467c530218973604d07d0247e6a64488c82471ab378bba773ac3250df5bbcb9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 0467c530218973604d07d0247e6a64488c82471ab378bba773ac3250df5bbcb9

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558161/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample