MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24257f975caa403c4c548fd056d1bcade1b40fed342a4e69d7a90e3e837514ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	24257f975caa403c4c548fd056d1bcade1b40fed342a4e69d7a90e3e837514ec
SHA3-384 hash:	d6a05091493bc2638cf2b4f554728a0071ab65abde4099b762b466f4c9b7c049ac1dab0a8e135cfcc376ee33a68bafab
SHA1 hash:	3aec956c3326258627d29118b9bb77c3e969ef9b
MD5 hash:	e38b08dacd00ace020f89a08601f1773
humanhash:	india-speaker-missouri-equal
File name:	mips
Download:	download sample
File size:	592'688 bytes
First seen:	2025-06-29 04:22:33 UTC
Last seen:	2025-06-29 09:02:30 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zM:W7v+mrY2xzf03yvZ/YIs
TLSH	T1D7C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9
telfhash	t10ab0011070740bb84308e12d5cdcae5679f20cc3fe470c27db6047a159b54434d00d18
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6860c02b37c3436779470142linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Sends data to a server

Changes the time when the file was created, accessed, or modified

Opens a port

DNS request

Connection attempt

Locks files

Changes access rights for a written file

Creating a process from a recently created file

Launching a process

Receives data from a server

Creates directories

Runs as daemon

Creates or modifies files in /cron to set up autorun

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

mips

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/24257f975caa403c4c548fd056d1bcade1b40fed342a4e69d7a90e3e837514ec

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 84.28.2.133:6881
type: 185.150.189.63:6881
type: 159.65.34.10:6881
type: 109.111.144.194:6881
type: 46.252.122.133:6881
type: 95.220.140.192:6881
type: 90.26.230.99:6881
type: 92.245.30.11:6881
type: 51.159.76.32:6881
type: 93.176.180.96:6881
type: 178.69.209.93:6881
type: 178.71.161.38:6881
type: 176.125.139.123:6881
type: 89.207.71.47:6881
type: 188.42.55.92:6881
type: 88.101.93.63:6881
type: 87.98.162.88:6881
type: 5.23.108.77:6881
type: 86.202.65.0:6881
type: 185.148.1.223:6881
type: 109.168.27.186:6881
type: 94.138.169.12:6881
type: 46.173.144.7:6881
type: 213.193.15.167:6881
type: 70.49.171.238:6881
type: 188.81.79.146:6881
type: 18.221.7.72:6881
type: 94.61.41.250:6881
type: 148.135.106.206:6881
type: 52.9.197.152:6881
type: 2.69.38.66:6881
type: 54.214.105.212:6881
type: 141.11.92.129:6881
type: 35.167.186.212:6881
type: 35.155.156.153:6881
type: 18.188.31.0:6881
type: 213.14.193.6:6881
type: 95.79.69.93:6881
type: 109.151.108.132:6881
type: 195.32.127.86:6881
type: 77.235.216.18:6881
type: 74.14.160.53:6881
type: 36.151.181.201:6881
type: 86.165.115.56:6881
type: 18.190.61.127:6881
type: 192.99.3.72:6881
type: 75.119.138.164:6881
type: 109.186.14.157:6881
type: 46.152.128.81:6881
type: 130.239.18.158:8516
type: 140.245.76.181:9081
type: 178.162.173.91:28003
type: 178.162.174.178:28003
type: 178.162.173.105:28003
type: 178.162.173.48:28003
type: 148.153.188.242:6880
type: 195.154.233.74:6880
type: 45.203.151.81:6880
type: 173.230.130.111:6880
type: 45.203.154.77:6880
type: 130.239.18.158:8580
type: 81.171.22.205:28013
type: 178.162.174.222:28013
type: 130.239.18.158:8539
type: 130.239.18.158:8513
type: 5.135.156.163:56843
type: 65.21.125.170:50000
type: 135.181.227.244:50000
type: 65.21.128.217:50000
type: 37.27.120.55:50000
type: 37.27.117.249:50000
type: 37.27.117.250:50000
type: 65.21.128.241:50000
type: 65.21.33.208:50000
type: 65.21.34.43:50000
type: 135.181.238.57:50000
type: 65.108.198.44:50000
type: 37.27.104.56:50000
type: 37.27.103.179:50000
type: 178.162.174.222:28014
type: 178.162.173.220:28014
type: 178.162.173.17:28014
type: 178.162.144.51:21183
type: 185.81.126.175:8535
type: 88.151.144.30:8535
type: 76.146.162.20:42866
type: 197.243.9.42:38831
type: 37.27.113.233:48172
type: 37.187.1.102:51413
type: 176.195.53.250:51413
type: 95.246.21.24:51413
type: 163.172.38.214:51413
type: 151.80.44.142:51413
type: 178.79.183.54:51413
type: 176.36.200.189:51413
type: 178.40.201.185:51413
type: 129.151.214.231:51413
type: 198.27.67.208:51413
type: 95.31.43.219:51413
type: 84.217.73.58:51413
type: 109.194.107.65:51413
type: 213.160.63.116:51413
type: 83.68.250.164:51413
type: 130.239.18.158:8554
type: 178.162.173.102:28005
type: 178.162.173.221:28005
type: 178.162.174.234:28000
type: 178.162.174.221:28000
type: 95.216.3.25:15761
type: 178.162.173.89:28007
type: 178.162.173.147:28007
type: 176.165.31.250:23246
type: 82.12.177.91:21729
type: 188.141.39.241:35991
type: 166.70.232.156:54065
type: 5.79.68.69:47544
type: 161.97.101.151:36153
type: 5.196.69.64:58810
type: 131.100.130.28:27224
type: 130.239.18.158:8510
type: 178.162.174.170:28001
type: 178.162.173.231:28001
type: 178.162.173.229:28001
type: 178.162.173.108:28001
type: 185.149.91.21:51118
type: 130.239.18.158:8520
type: 212.7.202.40:28030
type: 79.106.231.163:1434
type: 178.162.174.43:28004
type: 178.162.174.173:28004
type: 178.162.174.9:28004
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 163.172.13.241:58761
type: 130.239.18.158:8508
type: 46.232.211.190:13709
type: 95.168.162.161:42670
type: 96.30.101.216:15301
type: 176.147.145.68:31228
type: 178.162.173.103:28010
type: 83.237.67.34:49001
type: 46.39.22.19:49001
type: 178.69.27.219:49001
type: 95.53.8.186:49001
type: 51.159.104.68:7606
type: 95.211.20.1:21170
type: 188.163.4.162:64252
type: 103.140.3.20:22637
type: 168.138.9.186:65533
type: 178.162.173.142:28012
type: 178.162.173.32:28012
type: 72.167.135.165:12607
type: 89.149.226.91:53380
type: 114.33.47.46:30006
type: 213.91.248.41:19366
type: 222.155.21.113:22945
type: 176.31.104.205:62953
type: 116.241.162.4:36709
type: 46.10.41.105:31295
type: 2.87.107.9:58447
type: 14.137.79.198:38461
type: 45.87.251.144:2700
type: 1.120.215.53:20963
type: 161.142.155.26:4096
type: 148.66.17.218:11141
type: 46.232.210.133:64053
type: 188.165.198.14:54826
type: 218.152.174.128:64145
type: 82.141.96.30:6889
type: 95.234.183.164:6889
type: 72.178.237.66:6889
type: 110.66.82.23:6889
type: 93.57.41.154:6889
type: 110.232.134.102:13480
type: 42.2.93.154:65432
type: 5.163.166.189:39719
type: 216.209.208.55:12781
type: 185.152.74.143:54321
type: 113.39.136.107:26570
type: 31.15.134.26:54470
type: 83.87.104.95:60216
type: 59.126.173.42:34567
type: 80.234.1.170:6882
type: 142.134.67.196:6882
type: 186.23.28.240:43877
type: 189.154.112.4:55374
type: 191.23.68.156:6005
type: 32.220.104.13:17511
type: 181.88.205.6:38148
type: 195.154.172.179:23596
type: 184.182.119.211:30200
type: 188.74.69.108:49693
type: 89.138.220.93:23952
type: 208.104.102.226:46579
type: 69.250.49.184:39926
type: 180.49.221.51:57437
type: 68.41.17.173:29156
type: 24.65.22.55:41654
type: 181.223.2.170:55393
type: 152.57.161.167:38545
type: 174.2.160.65:11278
type: 194.29.101.83:10240
type: 152.53.104.128:10240
type: 195.170.172.38:10240
type: 167.172.226.132:6060
type: 208.87.240.21:11158
type: 95.214.53.172:1688
type: 51.15.19.75:3063
type: 85.72.82.215:27801
type: 197.48.230.150:40440
type: 5.79.66.16:52210
type: 93.127.128.73:58458
type: 176.31.183.98:61498
type: 189.203.27.24:13483
type: 95.68.46.203:33544
type: 54.36.168.18:46075
type: 109.148.179.239:54007
type: 130.239.18.158:8500
type: 5.182.17.111:5091
type: 178.162.214.222:32490
type: 212.7.204.120:60062
type: 83.149.73.134:51934
type: 173.249.217.38:35996
type: 76.69.130.28:23487
type: 187.189.221.207:23255
type: 54.77.218.23:6992
type: 35.171.49.86:6992
type: 144.76.70.35:51391
type: 217.146.88.83:50666
type: 70.68.76.237:20403
type: 217.10.125.106:42207
type: 188.165.244.171:53926
type: 97.80.67.103:6894
type: 212.7.202.11:46211
type: 5.79.67.52:16742
type: 152.53.45.107:7242
type: 89.149.197.229:56026
type: 61.238.192.43:10628
type: 68.206.66.24:13965
type: 60.133.232.135:21034
type: 223.231.136.197:54373
type: 173.179.70.192:30811
type: 46.105.51.64:6912
type: 185.203.56.43:29949
type: 51.195.220.36:8664
type: 51.15.183.133:53390
type: 95.211.191.121:42535
type: 95.211.198.95:28009
type: 94.224.51.220:18824
type: 46.232.211.143:64240
type: 82.102.23.131:42230
type: 89.159.99.157:31587
type: 178.150.248.92:32198
type: 124.121.27.242:59003
type: 94.244.115.229:63907
type: 94.75.194.36:60773
type: 212.7.202.213:11778
type: 47.236.105.55:53695
type: 92.32.68.163:61444
type: 38.156.216.172:16577

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/637bc065-8ae0-4a33-bd03-a96e8964e488

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e5c0d6fe-5496-4cbb-8fba-e2de8926e0c7

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/24257f975caa403c4c548fd056d1bcade1b40fed342a4e69d7a90e3e837514ec

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/24257f975caa403c4c548fd056d1bcade1b40fed342a4e69d7a90e3e837514ec/

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2025-06-29 04:25:09 UTC

File Type:

ELF32 Big (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eqsx7f24vjadytcur7ifnun4vxq3id7ngqve42oxvehd5a3vctwa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250629-eznw7afk5x/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/81e1c092-4d26-49f7-964f-eda0e7afc02d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/24257f975caa403c4c548fd056d1bcade1b40fed342a4e69d7a90e3e837514ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 24257f975caa403c4c548fd056d1bcade1b40fed342a4e69d7a90e3e837514ec

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558223/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample