MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 136051d54ddc5bb165a348d02e2b2f6d2de3d7f2cb57170b52199198d018a4de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ladvix


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 136051d54ddc5bb165a348d02e2b2f6d2de3d7f2cb57170b52199198d018a4de
SHA3-384 hash: 4395ca420cb4311f8071bb2bf2c6cf64f866112ce7c8537942857da9982a4b65aca9f6915f01dc095e7e8ee130ed9531
SHA1 hash: e1c33ca4b8fb21c0ad5450e736b30b1745a3a813
MD5 hash: edc63468d66f45bf7200bd28281792c0
humanhash: mirror-bluebird-johnny-virginia
File name:mig
Download: download sample
Signature Ladvix
Create hunting rule
File size:30'687 bytes
First seen:2026-01-18 22:54:28 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 384:BWskamFsqGhR9j1slGMsNDnPekW0N5uUsp9PiioAnQW/5gBUBqRGFFViVH/gD2ov:AFTaLRRaolEnQqF6gio
TLSH T16ED2C607BB619E39C09593B04DDF91B1773374B5AB23660B378AB3316680B884F2DA57
telfhash t1f6b00121eb906524a6b1da0a6a533e48b46a31e5b0756164299f6101b61c64526d3004
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf Ladvix

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Unix.Virus.Ladvix-10005306-0
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
rust virus
Link:
https://www.filescan.io/uploads/696d64e82ea17ed899528aae/reports/db000470-f435-4f0b-aaf8-f5164d023403/overview
Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a0983498-12a1-470f-b96b-e0b454b8cbe7
Behavior Graph:
Download SVG
%3 guuid=2cd435fd-1600-0000-ec24-d88c250d0000 pid=3365 /usr/bin/sudo guuid=9f9f8cff-1600-0000-ec24-d88c2b0d0000 pid=3371 /tmp/sample.bin delete-file write-file guuid=2cd435fd-1600-0000-ec24-d88c250d0000 pid=3365->guuid=9f9f8cff-1600-0000-ec24-d88c2b0d0000 pid=3371 execve guuid=b1e8a272-1700-0000-ec24-d88c740e0000 pid=3700 /tmp/fileujiLhu guuid=9f9f8cff-1600-0000-ec24-d88c2b0d0000 pid=3371->guuid=b1e8a272-1700-0000-ec24-d88c740e0000 pid=3700 execve
Malware family:
RHOMBUS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/388a7c5f-f2e0-4e6b-afb2-27635df47902
Result
Threat name:
Ladvix
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1853039
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample tries to persist itself using cron
Sample tries to set files in /etc globally writable
Writes identical ELF files to multiple locations
Yara detected Ladvix
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1853039 Sample: mig.elf Startdate: 18/01/2026 Architecture: LINUX Score: 76 77 169.254.169.254, 80 USDOSUS Reserved 2->77 79 109.202.202.202, 80 INIT7CH Switzerland 2->79 81 2 other IPs or domains 2->81 91 Malicious sample detected (through community Yara rule) 2->91 93 Multi AV Scanner detection for submitted file 2->93 95 Yara detected Ladvix 2->95 15 mig.elf 2->15         started        19 python3.8 dpkg 2->19         started        signatures3 process4 file5 75 /tmp/fileDnFjhQ, ELF 15->75 dropped 83 Sample tries to set files in /etc globally writable 15->83 85 Sample tries to persist itself using cron 15->85 21 mig.elf fileDnFjhQ 15->21         started        signatures6 process7 file8 61 /tmp/filecj93Jd, ELF 21->61 dropped 97 Writes identical ELF files to multiple locations 21->97 25 fileDnFjhQ filecj93Jd 21->25         started        signatures9 process10 file11 67 /tmp/filebVuv5s, ELF 25->67 dropped 103 Writes identical ELF files to multiple locations 25->103 29 filecj93Jd filebVuv5s 25->29         started        signatures12 process13 file14 71 /tmp/file27ec1g, ELF 29->71 dropped 107 Writes identical ELF files to multiple locations 29->107 33 filebVuv5s file27ec1g 29->33         started        signatures15 process16 file17 57 /tmp/file2FTcdE, ELF 33->57 dropped 87 Writes identical ELF files to multiple locations 33->87 37 file27ec1g file2FTcdE 33->37         started        signatures18 process19 file20 63 /tmp/fileirEJIQ, ELF 37->63 dropped 99 Writes identical ELF files to multiple locations 37->99 41 file2FTcdE fileirEJIQ 37->41         started        signatures21 process22 file23 69 /tmp/filef6TqDf, ELF 41->69 dropped 105 Writes identical ELF files to multiple locations 41->105 45 fileirEJIQ filef6TqDf 41->45         started        signatures24 process25 file26 73 /tmp/fileWmBiOI, ELF 45->73 dropped 109 Writes identical ELF files to multiple locations 45->109 49 filef6TqDf fileWmBiOI 45->49         started        signatures27 process28 file29 59 /tmp/filehzZMt2, ELF 49->59 dropped 89 Writes identical ELF files to multiple locations 49->89 53 fileWmBiOI filehzZMt2 49->53         started        signatures30 process31 file32 65 /tmp/fileUX1ckh, ELF 53->65 dropped 101 Writes identical ELF files to multiple locations 53->101 signatures33
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/136051d54ddc5bb165a348d02e2b2f6d2de3d7f2cb57170b52199198d018a4de
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/136051d54ddc5bb165a348d02e2b2f6d2de3d7f2cb57170b52199198d018a4de/
Verdict:
Malicious
Threat:
Family.LADVIX
Link:
https://tip.neiki.dev/file/136051d54ddc5bb165a348d02e2b2f6d2de3d7f2cb57170b52199198d018a4de
Threat name:
Linux.Trojan.Ladvix
Create hunting rule
Status:
Malicious
First seen:
2026-01-18 22:55:48 UTC
File Type:
ELF64 Little (SO)
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cnqfdvkn3rn3czndjdic4kzpnuw6hv7sznlroc2sdgizruayutpa._file
Result
Malware family:
ladvix
Create hunting rule
Score:
  10/10
Tags:
family:ladvix discovery execution infector linux persistence privilege_escalation trojan
Link:
https://tria.ge/reports/260118-2we67sg17f/
Behaviour
Writes file to tmp directory
Reads runtime system information
Creates/modifies Cron job
Writes file to system bin folder
Executes dropped EXE
Ladvix
Ladvix family
Verdict:
Malicious
Tags:
red_team_tool trojan Unix.Virus.Ladvix-10005306-0
YARA:
Linux_Hacktool_Cleanlog_3eb725d1 Linux_Hacktool_Cleanlog_400b7595 Linux_Trojan_Ladvix_db41f9d2
Link:
https://app.threat.zone/submission/cf509a1c-0d93-43f2-ae77-dcdc8cdf08c9
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Hacktool_Cleanlog_3eb725d1
Create hunting rule
Author:Elastic Security
Rule name:Linux_Hacktool_Cleanlog_400b7595
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Ladvix_db41f9d2
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Ladvix

elf 136051d54ddc5bb165a348d02e2b2f6d2de3d7f2cb57170b52199198d018a4de

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3760004/
  
Delivery method
Distributed via web download

Comments