MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18f8e2ee5bcf5ff764f5fb24b74cbb58f54e85981fc70835a23d0d135843170c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18f8e2ee5bcf5ff764f5fb24b74cbb58f54e85981fc70835a23d0d135843170c
SHA3-384 hash: 783cc1107fba65e3156afd52d9b9fd61d409bf150d4d07e286ee0f20fab6f5f0ec4c075283a629181cb20bf5bb2c3066
SHA1 hash: 858feb83f7eff762e33a2c90a366195ce3f85d9b
MD5 hash: 0c9ea37be35f6d9ff7277b8688769256
humanhash: spaghetti-green-fifteen-maine
File name:bot
Download: download sample
File size:3'716'476 bytes
First seen:2025-12-17 23:17:35 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 98304:xtwkcwvxVBs/+BX0DLI218I/9ZRv5Y2UfU:c+TU+cI2jXRBS8
TLSH T1070633F82333E4B7A340AC39D4170562451A02A518CF737DCB68852BDE369F11AEA5FB
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
39
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/69433a35e126b9ff4385c6d6/reports/019193d8-f9fd-4162-9ee8-9b5a3aa4c7ef/overview
Verdict:
Adware
File Type:
elf.64.le
First seen:
2025-12-17T12:42:00Z UTC
Last seen:
2025-12-18T00:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/18f8e2ee5bcf5ff764f5fb24b74cbb58f54e85981fc70835a23d0d135843170c/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d7e8cdcf-6eb0-48d7-933b-8fbcaf21e13c
Behavior Graph:
Download SVG
%3 guuid=a7f6e9b7-1900-0000-9b1e-ac4565140000 pid=5221 /usr/bin/sudo guuid=09e771ba-1900-0000-9b1e-ac4566140000 pid=5222 /tmp/sample.bin write-file guuid=a7f6e9b7-1900-0000-9b1e-ac4565140000 pid=5221->guuid=09e771ba-1900-0000-9b1e-ac4566140000 pid=5222 execve
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9700b929-3282-4a79-8596-fe3b1e19cb57
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
1 / 100
Link:
https://www.joesandbox.com/analysis/1835342
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/18f8e2ee5bcf5ff764f5fb24b74cbb58f54e85981fc70835a23d0d135843170c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18f8e2ee5bcf5ff764f5fb24b74cbb58f54e85981fc70835a23d0d135843170c/
Threat name:
Linux.Trojan.SAgnt
Create hunting rule
Status:
Malicious
First seen:
2025-12-17 22:56:59 UTC
File Type:
ELF64 Little (SO)
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dd4of3s3z5p7ozhv7mslotf3ld2u5bmyd7dqqnnchugrgwcdc4ga._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/251217-3ac1dsf14e/
Behaviour
Reads runtime system information
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/31ec61fc-5580-477d-a935-608101984b8a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/18f8e2ee5bcf5ff764f5fb24b74cbb58f54e85981fc70835a23d0d135843170c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 18f8e2ee5bcf5ff764f5fb24b74cbb58f54e85981fc70835a23d0d135843170c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3734892/
  
Delivery method
Distributed via web download

Comments