MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cca24c39a620a73050b1b80695bfb402cde3f3da4fa0c9c128e743378ff863e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	1cca24c39a620a73050b1b80695bfb402cde3f3da4fa0c9c128e743378ff863e
SHA3-384 hash:	e3e83f916517ddde6b2511b7e87009a7f09e9d9f85f5acc6af2536b4f2922faf6760b499103cef497eb5023d2dd2f850
SHA1 hash:	0346e55d360d80dcd68f7d34bcbc936136cb918d
MD5 hash:	5b896689f50df85bcea3ec42fc3eb5d6
humanhash:	pizza-burger-emma-two
File name:	mips
Download:	download sample
File size:	592'688 bytes
First seen:	2025-07-03 23:14:10 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zt:W7v+mrY2xzf03yvZ/YIN
TLSH	T1F0C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9
telfhash	t10ab0011070740bb84308e12d5cdcae5679f20cc3fe470c27db6047a159b54434d00d18
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68670ec9c9eb974737660b50linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Creates directories

Locks files

Changes access rights for a written file

Creating a process from a recently created file

Changes the time when the file was created, accessed, or modified

Receives data from a server

Runs as daemon

Creating a file

Opens a port

Launching a process

Sends data to a server

Connection attempt

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

exploit gcc

Link:

https://www.filescan.io/uploads/68670eca967c7aaba4d05dd1/reports/80ca54bf-b5d0-4296-8f2a-6de5b987a17e/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

mips

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/1cca24c39a620a73050b1b80695bfb402cde3f3da4fa0c9c128e743378ff863e

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 94.190.121.108:6881
type: 78.102.89.35:6881
type: 63.247.211.162:6881
type: 148.63.132.234:6881
type: 212.156.245.134:6881
type: 37.2.166.222:6881
type: 216.128.97.44:6881
type: 72.134.83.199:6881
type: 120.28.214.81:6881
type: 134.209.183.166:6881
type: 31.15.169.172:6881
type: 185.153.146.20:6881
type: 211.221.201.156:6881
type: 82.67.34.70:6881
type: 24.113.92.119:6881
type: 45.230.216.11:6881
type: 64.7.199.5:6881
type: 118.240.177.248:6881
type: 151.237.71.24:6881
type: 176.65.60.241:6881
type: 107.181.234.235:6881
type: 23.95.192.22:6881
type: 52.9.197.152:6881
type: 74.48.140.189:6881
type: 142.171.125.191:6881
type: 119.28.68.97:6881
type: 167.99.72.189:6881
type: 75.119.138.164:6881
type: 3.92.204.118:6881
type: 88.87.84.154:6881
type: 5.101.195.120:6881
type: 20.235.201.210:6881
type: 109.50.249.164:6881
type: 35.167.186.212:6881
type: 188.34.199.148:6881
type: 5.228.188.30:6881
type: 94.241.41.156:6881
type: 82.15.109.212:6881
type: 73.71.63.254:6881
type: 54.70.174.84:6881
type: 176.136.205.22:6881
type: 135.181.238.57:50000
type: 135.181.238.125:50000
type: 135.181.227.244:50000
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 178.162.174.43:28004
type: 178.162.174.227:28004
type: 178.162.174.149:28001
type: 178.162.174.220:28001
type: 178.162.173.141:28001
type: 185.107.71.105:27633
type: 73.138.202.72:6882
type: 185.183.35.248:6882
type: 95.64.191.126:6882
type: 112.82.166.34:6882
type: 178.162.173.163:28006
type: 138.199.27.226:51413
type: 192.222.172.154:51413
type: 198.100.145.51:51413
type: 77.37.246.87:51413
type: 94.190.112.28:51413
type: 45.132.114.236:51413
type: 89.168.69.159:51413
type: 37.187.20.193:51413
type: 5.135.163.217:51413
type: 5.9.23.101:51413
type: 5.39.95.146:51413
type: 5.135.155.133:51413
type: 5.135.158.154:51413
type: 90.55.181.216:51413
type: 86.28.217.76:51413
type: 91.116.156.149:51413
type: 37.59.40.98:51413
type: 199.38.85.15:51413
type: 65.21.13.101:51413
type: 49.69.135.115:51413
type: 82.209.216.33:51413
type: 192.184.177.155:51413
type: 24.124.89.172:51413
type: 46.242.21.247:51413
type: 178.162.173.111:28008
type: 45.137.212.175:29469
type: 83.21.163.6:52635
type: 157.230.13.174:56743
type: 195.154.233.74:6880
type: 52.70.34.253:6880
type: 3.141.159.213:6880
type: 3.12.65.135:6880
type: 148.153.170.2:6880
type: 147.135.11.99:6880
type: 50.17.19.6:6880
type: 45.203.154.67:6880
type: 148.153.188.210:6880
type: 178.162.174.185:28003
type: 178.162.173.91:28003
type: 178.162.173.105:28003
type: 195.201.179.130:16309
type: 130.239.18.158:8500
type: 130.239.18.158:8580
type: 130.239.18.158:8516
type: 130.239.18.158:8597
type: 130.239.18.158:8513
type: 46.232.211.148:11209
type: 185.132.179.61:6892
type: 105.216.98.167:35344
type: 149.34.245.152:47955
type: 142.202.48.88:10099
type: 69.50.95.40:10000
type: 23.243.135.12:30569
type: 184.167.105.9:65189
type: 93.165.252.80:11887
type: 81.171.20.66:64010
type: 178.162.173.172:28009
type: 178.162.174.102:28009
type: 37.48.118.87:28000
type: 45.87.251.132:28129
type: 37.48.95.36:40253
type: 178.162.174.226:28005
type: 95.168.168.234:52277
type: 46.232.211.211:64183
type: 51.159.104.76:7186
type: 172.111.38.128:26078
type: 178.57.21.226:49001
type: 31.181.49.5:49001
type: 87.203.94.188:49001
type: 45.151.107.173:54058
type: 51.159.104.67:7105
type: 46.232.211.211:58145
type: 183.97.84.214:65339
type: 54.211.14.111:20871
type: 185.149.91.171:51010
type: 119.197.192.253:40737
type: 172.111.38.128:26084
type: 45.142.213.91:1027
type: 81.171.22.85:28016
type: 114.34.138.206:51417
type: 79.106.231.163:1434
type: 178.162.174.222:28014
type: 115.129.156.209:15726
type: 188.165.246.171:57349
type: 176.63.9.21:4201
type: 185.21.216.198:51062
type: 5.39.85.86:56099
type: 185.21.216.198:53220
type: 62.45.39.152:17303
type: 212.32.239.73:55993
type: 121.146.8.245:40858
type: 5.39.85.155:54758
type: 24.99.72.184:61028
type: 46.232.210.26:64087
type: 121.164.87.58:65390
type: 212.95.156.102:61836
type: 43.134.56.88:60020
type: 85.132.252.42:62110
type: 138.19.29.247:13382
type: 89.25.26.214:20482
type: 5.2.73.209:6951
type: 178.162.173.56:28011
type: 193.23.249.225:50171
type: 46.29.25.158:57657
type: 115.163.107.125:6889
type: 114.34.73.133:6889
type: 185.152.120.31:6889
type: 58.241.139.175:6889
type: 185.203.56.2:18148
type: 185.180.223.80:63267
type: 112.167.5.244:32803
type: 194.187.251.115:31270
type: 105.110.138.229:52188
type: 38.88.124.109:33961
type: 112.161.158.134:15885
type: 186.23.28.151:46066
type: 200.219.34.104:24193
type: 190.231.234.88:5779
type: 46.4.113.198:41600
type: 37.27.113.233:39382
type: 185.21.216.184:17373
type: 81.172.207.185:59786
type: 106.167.148.9:34115
type: 86.108.33.11:7626
type: 181.130.37.245:25501
type: 221.138.17.180:30773
type: 96.54.108.140:57155
type: 72.27.108.211:55720
type: 192.140.254.77:15914
type: 168.181.15.170:21452
type: 54.39.52.64:23883
type: 158.69.224.81:36034
type: 152.53.52.107:10240
type: 5.77.199.162:44461
type: 59.1.251.190:32964
type: 114.32.76.234:58048
type: 58.176.62.28:9010
type: 72.51.112.152:34353
type: 95.214.53.172:1688
type: 196.210.29.52:10708
type: 152.53.45.107:6886
type: 130.239.18.158:8603
type: 128.127.105.184:26398
type: 78.30.11.193:9602
type: 5.79.112.176:51142
type: 46.232.210.208:64074
type: 62.235.40.199:56061
type: 83.149.117.214:28230
type: 81.240.163.228:28027
type: 65.108.143.34:55761
type: 37.27.113.233:55761
type: 37.27.113.233:39361
type: 144.76.175.153:39407
type: 65.108.143.34:55751
type: 80.216.255.57:31640
type: 37.48.89.172:46011
type: 112.118.53.130:23876
type: 60.95.240.129:10344
type: 5.79.80.223:28007
type: 84.69.56.183:23241
type: 46.201.249.217:45102
type: 77.29.45.67:18557
type: 77.21.253.74:2555
type: 83.249.174.216:51415
type: 185.149.91.157:51008
type: 72.167.53.164:11068
type: 46.232.211.222:64020
type: 112.170.240.208:63159
type: 57.134.122.44:41231
type: 201.71.166.48:53501
type: 59.9.255.226:32889
type: 5.104.85.81:55867
type: 14.38.0.139:41287
type: 14.32.64.183:33060
type: 193.32.16.241:55159
type: 43.130.56.223:6000
type: 38.134.41.130:32681

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/574e0f44-1824-4707-966d-9728a51b2a6c

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/7f2a9cec-7af6-4fa7-b3e4-80adce0bfbf7

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/1cca24c39a620a73050b1b80695bfb402cde3f3da4fa0c9c128e743378ff863e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1cca24c39a620a73050b1b80695bfb402cde3f3da4fa0c9c128e743378ff863e/

Threat name:

Linux.Dropper.Multiverze

Status:

Malicious

First seen:

2025-07-03 23:15:14 UTC

File Type:

ELF32 Big (Exe)

AV detection:

18 of 38 (47.37%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dtfcjq42mifhgbildoagsw73iawn4pz5ut5azhasrz2dg6h7qy7a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250703-28scastyhx/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/d5b54aae-8ef8-4836-ad04-f8178a0d0e82

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1cca24c39a620a73050b1b80695bfb402cde3f3da4fa0c9c128e743378ff863e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 1cca24c39a620a73050b1b80695bfb402cde3f3da4fa0c9c128e743378ff863e

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558223/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample