MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d3056efc9a46e9dd5b1a5c7d107bfeab6ec047b46aa64e053a12eba375c50b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	0d3056efc9a46e9dd5b1a5c7d107bfeab6ec047b46aa64e053a12eba375c50b4
SHA3-384 hash:	5f5b7e3c013d3715b0e47da18744f887ab1fe4d322da8b969b36a86e11c5f9db4e779a697fd939e600ea9001891eee58
SHA1 hash:	0e5ae2c1534cf0f41fa00320556ca41fa79eb8b6
MD5 hash:	19de400d8c267ecbe005ba00e73c150f
humanhash:	bravo-maryland-fourteen-utah
File name:	arm926t
Download:	download sample
File size:	480'792 bytes
First seen:	2025-06-28 16:51:52 UTC
Last seen:	2025-06-29 05:28:39 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
TLSH	T1FCA41294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800
telfhash	t186c08c8c0fd401beba7d72a203bef2bf61a072f0be0224920404eb6f074c584028144c
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Siggen.9148.UNOFFICIAL

Sanesecurity.Malware.32055.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68601dbf37c343677946a883linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Creating a file in the %temp% directory

Creates directories

Sends data to a server

Creating a process from a recently created file

Changes the time when the file was created, accessed, or modified

Locks files

Collects information on the CPU

Connection attempt

Changes access rights for a written file

Launching a process

Opens a port

Runs as daemon

Receives data from a server

DNS request

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

exploit gcc lolbin remote

Link:

https://www.filescan.io/uploads/68601dd645e80b29f8a3969e/reports/14ad8755-d842-4432-b9d4-4b7390c78e59/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

103

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/0d3056efc9a46e9dd5b1a5c7d107bfeab6ec047b46aa64e053a12eba375c50b4

Behaviour

Anti-VM

Persistence

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 178.69.209.93:6881
type: 141.250.123.33:6881
type: 176.125.139.123:6881
type: 95.37.26.86:6881
type: 176.72.161.201:6881
type: 98.210.29.165:6881
type: 90.14.218.157:6881
type: 89.207.71.47:6881
type: 188.42.55.92:6881
type: 61.244.108.20:6881
type: 213.93.30.217:6881
type: 109.170.14.101:6881
type: 193.233.167.19:6881
type: 78.62.143.84:6881
type: 76.10.241.202:6881
type: 80.240.6.145:6881
type: 92.124.92.44:6881
type: 14.43.49.206:6881
type: 80.115.53.142:6881
type: 18.221.7.72:6881
type: 86.23.100.120:6881
type: 67.208.55.127:6881
type: 80.242.34.103:6881
type: 18.191.2.28:6881
type: 147.148.214.137:6881
type: 125.34.62.158:6881
type: 78.63.22.28:6881
type: 192.227.221.84:6881
type: 54.194.124.68:6881
type: 35.163.251.58:6881
type: 109.245.100.117:6881
type: 31.162.165.231:6881
type: 18.188.31.0:6881
type: 18.220.82.190:6881
type: 90.176.4.89:6881
type: 52.78.213.8:6881
type: 109.105.65.98:6881
type: 126.75.21.168:6881
type: 51.175.17.104:6881
type: 86.10.87.157:6881
type: 178.162.174.222:28014
type: 52.21.231.83:6880
type: 3.228.205.146:6880
type: 52.70.34.253:6880
type: 173.230.130.111:6880
type: 195.137.220.143:6880
type: 115.165.117.14:6880
type: 130.239.18.158:8515
type: 130.239.18.158:8524
type: 135.181.238.57:50000
type: 135.181.227.244:50000
type: 190.45.71.164:50000
type: 178.162.174.43:28004
type: 31.210.173.50:27520
type: 178.162.174.65:28010
type: 178.162.174.68:28010
type: 178.162.173.154:28010
type: 134.215.5.39:21790
type: 82.172.167.161:6889
type: 79.11.107.190:6889
type: 208.70.98.39:6889
type: 178.162.174.169:28003
type: 178.162.174.227:28003
type: 178.162.174.178:28003
type: 213.227.152.142:28003
type: 178.162.174.233:28003
type: 79.106.231.163:1434
type: 83.254.226.199:8083
type: 193.32.23.181:50838
type: 92.255.176.227:51413
type: 46.109.11.85:51413
type: 45.83.232.30:51413
type: 188.166.98.93:51413
type: 198.100.145.51:51413
type: 84.217.73.58:51413
type: 95.31.43.219:51413
type: 198.27.67.208:51413
type: 5.135.163.217:51413
type: 5.135.155.133:51413
type: 45.154.86.136:51413
type: 37.187.120.225:51413
type: 172.219.34.87:51413
type: 175.128.146.136:51413
type: 185.81.192.65:51413
type: 195.201.152.73:51413
type: 165.227.22.48:51413
type: 72.217.64.60:51413
type: 129.154.62.182:51413
type: 192.30.89.67:54961
type: 104.195.12.40:25829
type: 178.162.173.163:28006
type: 83.149.84.32:28008
type: 95.211.247.101:28013
type: 213.227.151.25:28013
type: 178.162.174.46:28013
type: 5.79.122.80:28013
type: 5.9.41.13:53504
type: 195.216.43.64:54857
type: 37.132.116.188:60706
type: 175.160.86.200:3334
type: 77.166.49.217:3334
type: 220.73.53.71:7912
type: 37.48.86.173:28000
type: 178.162.174.143:28000
type: 178.162.174.221:28000
type: 213.227.152.133:28000
type: 45.152.211.113:56596
type: 185.132.179.66:6882
type: 178.132.4.27:6882
type: 142.180.165.59:6882
type: 36.151.181.205:6882
type: 77.37.168.110:6882
type: 142.215.164.108:6882
type: 69.50.95.40:10085
type: 185.149.91.185:51059
type: 195.154.171.138:30519
type: 212.7.200.93:23999
type: 178.162.173.89:28007
type: 81.171.7.65:28007
type: 5.135.165.33:6331
type: 88.198.230.221:49668
type: 185.21.216.185:60731
type: 185.203.56.68:62927
type: 172.96.121.2:6884
type: 178.162.174.45:28015
type: 178.162.174.9:28015
type: 178.79.124.85:46405
type: 23.162.56.55:10054
type: 185.132.179.61:6892
type: 54.194.135.233:6892
type: 54.209.131.199:6892
type: 5.182.17.111:5091
type: 24.70.216.163:27059
type: 158.46.120.180:49001
type: 213.135.87.15:49001
type: 51.148.138.30:49001
type: 85.174.35.168:49001
type: 95.54.210.44:49001
type: 94.154.222.81:49001
type: 194.36.81.70:49001
type: 51.195.150.96:51463
type: 45.87.251.11:28005
type: 178.162.174.226:28005
type: 185.21.217.5:14567
type: 83.149.84.32:28046
type: 69.50.95.40:10020
type: 45.156.188.27:12608
type: 195.5.56.185:18046
type: 95.168.162.161:42670
type: 178.162.173.231:28001
type: 178.162.173.96:28001
type: 130.239.18.158:8539
type: 45.87.251.132:28031
type: 213.120.230.115:30301
type: 5.39.85.82:53461
type: 212.32.253.225:21194
type: 51.195.217.134:8654
type: 37.48.95.56:45237
type: 72.21.17.103:31030
type: 164.132.162.3:57501
type: 185.107.71.105:27633
type: 177.75.59.57:4998
type: 51.159.104.76:7186
type: 178.162.173.215:28012
type: 72.21.17.6:63562
type: 72.21.17.102:61327
type: 46.232.210.157:64170
type: 51.75.73.209:8651
type: 88.171.24.18:33428
type: 87.219.118.152:18713
type: 62.93.178.248:34182
type: 46.232.211.154:64090
type: 203.94.33.117:44727
type: 118.36.139.160:7906
type: 221.165.213.203:40921
type: 185.203.56.27:64063
type: 121.173.209.246:15439
type: 151.80.32.192:32381
type: 47.200.11.203:25515
type: 218.158.79.3:32930
type: 46.232.210.84:64223
type: 184.64.36.97:32987
type: 14.36.174.223:33126
type: 144.76.175.153:35411
type: 5.79.77.76:41883
type: 178.215.169.185:42701
type: 185.57.5.216:55086
type: 122.46.24.94:56878
type: 221.71.152.240:9300
type: 68.144.120.216:48302
type: 31.10.136.58:54772
type: 121.186.153.213:47760
type: 105.246.118.197:51194
type: 129.146.200.62:8999
type: 51.159.104.60:8352
type: 210.195.239.0:14216
type: 190.199.173.127:26122
type: 94.30.222.123:56281
type: 176.31.183.108:57002
type: 92.151.62.115:39563
type: 211.217.103.184:42830
type: 188.165.240.192:50266
type: 88.236.97.117:55641
type: 62.122.202.8:3595
type: 46.249.67.199:31754
type: 190.193.117.101:39650
type: 184.75.221.82:55433
type: 125.143.24.155:40848
type: 211.251.9.50:8090
type: 97.94.162.218:45646
type: 46.232.211.133:64002
type: 169.150.223.240:64002
type: 46.232.211.133:64103
type: 46.232.211.133:58287
type: 46.232.211.133:64128
type: 106.168.215.67:42586
type: 82.67.108.232:21860
type: 121.55.243.99:38717
type: 177.181.5.68:20588
type: 176.237.203.154:21566
type: 101.47.5.169:60020
type: 45.152.209.18:54413
type: 79.90.157.236:19342
type: 70.65.162.98:50321
type: 187.252.194.88:39590
type: 184.147.191.38:48637
type: 164.132.162.3:56048
type: 189.120.76.32:15172
type: 123.176.20.235:21845
type: 186.220.223.211:43511
type: 124.120.130.106:11111
type: 181.116.47.4:57189
type: 23.158.56.120:16078
type: 27.60.16.246:32390
type: 176.58.227.35:28673
type: 95.214.53.172:1688
type: 185.203.56.73:17490
type: 41.141.9.168:27590
type: 146.59.3.81:10240
type: 175.194.253.176:40920
type: 95.211.226.162:21406
type: 65.108.143.34:28021
type: 14.44.82.133:7896
type: 87.74.192.32:24435
type: 37.27.113.233:28639
type: 5.135.178.12:58361
type: 91.175.40.187:33775
type: 72.21.17.104:15235
type: 90.205.192.153:15235
type: 89.253.157.155:25568
type: 61.75.17.46:28234
type: 185.139.176.111:1313
type: 171.97.75.8:6461
type: 144.132.212.209:62633
type: 185.21.216.130:53502
type: 37.27.113.233:35404
type: 54.209.131.199:6992
type: 46.232.210.84:64212
type: 5.135.138.216:17203
type: 190.150.168.217:60540
type: 188.165.244.171:58005
type: 82.18.181.173:38518
type: 106.193.186.71:1930
type: 213.21.5.157:41924
type: 185.145.245.151:8650
type: 185.21.217.45:51791
type: 185.21.217.45:54266

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ad587d4d-ec52-4a05-aa5b-f95b0f007eff

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b5b225b4-51f0-46aa-bfac-e4ef762437f5

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/0d3056efc9a46e9dd5b1a5c7d107bfeab6ec047b46aa64e053a12eba375c50b4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0d3056efc9a46e9dd5b1a5c7d107bfeab6ec047b46aa64e053a12eba375c50b4/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-06-28 16:52:27 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=buyfn36jurxj3vnruxd5cb575k3oybd3i2vgjyctuexlun24kc2a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250628-vdg5hsbq7w/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/68477e7e-b36e-497a-8d93-816e594c9f30

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0d3056efc9a46e9dd5b1a5c7d107bfeab6ec047b46aa64e053a12eba375c50b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 0d3056efc9a46e9dd5b1a5c7d107bfeab6ec047b46aa64e053a12eba375c50b4

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558478/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample