MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b51cf22da1914e8dbbf8c6becd3d2d09ae8388ea6b0d865f068cad38865b3ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	2b51cf22da1914e8dbbf8c6becd3d2d09ae8388ea6b0d865f068cad38865b3ef
SHA3-384 hash:	4772931ee79e200d48ee91e7badec962b9493465671fc47987a32ae81c1ea264d49f785d33cf4d61d6b951f8c22cd4e4
SHA1 hash:	82a99e802cb1399e8256425ee75ed1a1a14e1905
MD5 hash:	d8b01a6804f20d6413d96129b1fff5f2
humanhash:	oscar-sad-kansas-december
File name:	amd64
Download:	download sample
File size:	482'032 bytes
First seen:	2025-05-26 05:56:18 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR
TLSH	T1B9A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Siggen.9080.29610.20406.UNOFFICIAL

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=683403eaacf88f5815e6f991linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates directories

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

exploit gcc lolbin remote

Link:

https://www.filescan.io/uploads/68340289fd02ed5e0587b72f/reports/b3c62ae8-4fd7-4b7d-8b22-3e87862e51a3/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

x86

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/2b51cf22da1914e8dbbf8c6becd3d2d09ae8388ea6b0d865f068cad38865b3ef

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 178.69.209.93:6881
type: 45.154.86.83:6881
type: 82.0.131.185:6881
type: 89.212.62.57:6881
type: 92.253.247.109:6881
type: 176.193.122.141:6881
type: 82.144.130.22:6881
type: 184.146.9.145:6881
type: 92.248.146.207:6881
type: 47.183.116.23:6881
type: 81.5.114.158:6881
type: 46.72.126.4:6881
type: 188.42.55.92:6881
type: 178.32.217.211:6881
type: 185.126.142.12:6881
type: 176.35.192.29:6881
type: 217.112.15.47:6881
type: 88.151.91.31:6881
type: 134.209.183.166:6881
type: 176.28.65.137:6881
type: 95.66.217.20:6881
type: 77.91.110.124:6881
type: 81.49.1.10:6881
type: 205.250.144.171:6881
type: 37.187.140.76:6881
type: 87.206.104.12:6881
type: 54.214.105.212:6881
type: 61.83.190.12:6881
type: 122.202.232.158:6881
type: 159.196.33.7:6881
type: 146.185.219.93:6881
type: 94.30.54.78:6881
type: 45.67.33.225:6881
type: 27.7.80.107:6881
type: 125.125.237.179:6881
type: 51.75.78.69:6881
type: 38.58.178.186:6881
type: 81.240.137.237:6881
type: 84.194.44.120:6881
type: 194.87.252.253:6881
type: 46.162.75.130:6881
type: 46.59.103.87:6881
type: 79.105.131.61:6881
type: 124.140.170.143:6881
type: 52.9.197.152:6881
type: 78.67.205.79:6881
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 3.128.149.181:6880
type: 3.141.159.213:6880
type: 3.12.65.135:6880
type: 50.17.19.6:6880
type: 148.153.168.250:6880
type: 154.202.133.222:6880
type: 3.216.41.253:6880
type: 173.230.130.111:6880
type: 23.23.69.85:6880
type: 3.130.230.203:6880
type: 185.196.61.50:6880
type: 3.218.205.217:6880
type: 148.153.170.2:6880
type: 195.137.220.21:6880
type: 195.137.220.189:6880
type: 95.179.127.133:2309
type: 185.203.56.50:61573
type: 178.162.174.43:28004
type: 37.48.64.31:28004
type: 5.182.17.111:5091
type: 83.149.98.184:28014
type: 92.52.26.83:51413
type: 176.36.18.212:51413
type: 82.120.235.48:51413
type: 92.205.111.100:51413
type: 217.120.204.188:51413
type: 37.187.120.216:51413
type: 5.39.95.146:51413
type: 5.135.158.154:51413
type: 95.31.43.219:51413
type: 198.27.67.208:51413
type: 213.158.1.85:51413
type: 195.154.217.61:51413
type: 60.111.223.75:51413
type: 89.67.70.124:51413
type: 84.240.13.183:51413
type: 37.187.123.136:51413
type: 82.65.7.40:51413
type: 82.66.72.141:51413
type: 85.75.23.241:51413
type: 121.146.209.200:51413
type: 192.200.113.156:51413
type: 171.213.143.172:51413
type: 23.233.57.125:51413
type: 145.239.8.14:51413
type: 5.39.80.107:51413
type: 77.37.238.147:51413
type: 179.253.247.40:49001
type: 70.53.134.211:49001
type: 91.205.130.91:49001
type: 5.227.8.204:49001
type: 195.154.185.217:25249
type: 161.81.100.207:24247
type: 45.87.251.132:28145
type: 85.122.127.110:26881
type: 185.203.56.34:28550
type: 69.50.95.40:12092
type: 85.17.170.48:28016
type: 66.111.7.7:47806
type: 178.162.173.166:28005
type: 81.171.6.42:28005
type: 176.214.145.244:25987
type: 24.231.65.236:34238
type: 37.27.117.253:50000
type: 37.27.120.59:50000
type: 37.27.117.115:50000
type: 142.132.206.120:50000
type: 37.27.107.117:50000
type: 95.216.15.58:50000
type: 144.76.44.131:50000
type: 222.67.250.241:50000
type: 46.232.211.211:64183
type: 169.150.251.166:16659
type: 195.154.172.179:25256
type: 188.165.241.169:57395
type: 62.212.84.114:6911
type: 188.165.246.140:52347
type: 165.22.118.183:7063
type: 5.79.69.185:28006
type: 178.162.173.18:28006
type: 23.158.56.120:16097
type: 207.243.203.2:10013
type: 188.244.47.44:57852
type: 178.162.174.242:28013
type: 162.251.63.78:12022
type: 202.64.124.161:19334
type: 185.21.217.57:58920
type: 88.204.193.16:55581
type: 95.211.217.156:59265
type: 168.119.13.211:33541
type: 220.133.85.151:31415
type: 121.109.185.211:22850
type: 178.162.173.231:28001
type: 213.227.152.134:28001
type: 178.162.174.178:28003
type: 178.162.173.105:28003
type: 130.239.18.158:8539
type: 188.227.82.212:22387
type: 188.165.198.14:52291
type: 72.21.17.13:14720
type: 178.162.174.221:28000
type: 178.162.174.143:28000
type: 77.85.1.192:26576
type: 89.149.202.17:28045
type: 178.162.173.6:28008
type: 173.249.44.165:8081
type: 192.141.245.86:19727
type: 172.111.38.128:26084
type: 178.162.173.149:28012
type: 178.162.173.13:28012
type: 46.232.210.14:64007
type: 81.171.6.43:28002
type: 188.226.210.44:5060
type: 62.210.127.190:30420
type: 178.162.173.3:28011
type: 46.149.92.106:21103
type: 37.48.95.40:49263
type: 122.151.20.197:38244
type: 103.106.91.43:6889
type: 77.54.204.48:6889
type: 94.28.224.95:17686
type: 80.42.18.189:42115
type: 85.127.110.241:47601
type: 51.75.163.151:8652
type: 176.63.10.111:20068
type: 178.88.15.156:17372
type: 172.220.75.44:5104
type: 94.246.226.235:16690
type: 68.80.100.60:33500
type: 189.35.158.141:22168
type: 5.167.5.97:34611
type: 86.106.183.41:51414
type: 202.128.121.50:30909
type: 154.47.25.168:52241
type: 45.152.210.165:49643
type: 45.137.83.150:49643
type: 90.224.227.82:26829
type: 5.39.85.50:59553
type: 82.64.185.43:17200
type: 190.2.135.200:6882
type: 31.28.212.50:6882
type: 92.238.224.195:6882
type: 72.21.17.7:61181
type: 72.21.17.67:53701
type: 69.206.138.35:29097
type: 176.234.134.60:18096
type: 170.79.242.175:48499
type: 178.46.117.234:1028
type: 164.138.88.210:3073
type: 95.216.100.173:33490
type: 45.62.73.180:60889
type: 46.232.211.160:63655
type: 222.114.152.25:32847
type: 89.134.23.213:10413
type: 46.232.211.230:21509
type: 147.192.195.60:58604
type: 185.55.148.70:20481
type: 178.162.159.67:54545
type: 92.49.145.239:14207
type: 81.171.18.111:52028
type: 86.167.255.54:50321
type: 73.219.76.100:50321
type: 85.174.205.114:3962
type: 185.9.89.201:14635
type: 84.51.107.78:56151
type: 85.226.228.71:8999
type: 179.125.144.224:4488
type: 89.64.95.229:32709
type: 125.14.137.180:47455
type: 178.162.147.94:11908
type: 218.102.95.211:20070
type: 188.165.195.203:56836
type: 135.12.148.50:27547
type: 164.132.162.3:52216
type: 182.232.96.49:8895
type: 93.120.220.111:47167
type: 181.214.206.77:57184
type: 152.53.45.107:7338
type: 89.22.226.106:6934
type: 54.39.52.64:25568
type: 221.4.170.137:25568
type: 45.128.27.150:55368
type: 181.44.116.134:2347
type: 181.214.206.77:53045
type: 152.53.45.107:7332
type: 23.158.56.120:12008
type: 23.162.56.55:10030
type: 5.248.223.248:61343
type: 78.142.231.133:6767
type: 58.3.23.203:32783
type: 162.251.63.120:10002
type: 37.238.58.12:54653
type: 183.105.110.2:41159
type: 142.202.48.88:12070
type: 162.251.63.120:10040
type: 178.75.125.115:23119
type: 54.211.14.111:20871
type: 23.158.56.120:18095
type: 138.19.103.84:20252
type: 5.166.240.92:52325
type: 213.231.155.195:4712
type: 185.203.56.51:18522
type: 95.72.111.19:54686
type: 162.156.25.144:26431
type: 183.103.128.87:40891
type: 211.220.214.209:32814
type: 89.248.162.217:53894
type: 68.45.227.99:62923
type: 164.153.50.93:45417
type: 83.143.146.32:11158
type: 222.107.239.219:32754
type: 49.161.106.217:41040
type: 80.213.29.77:9008
type: 47.186.2.126:59715
type: 93.123.150.55:46107
type: 94.228.205.194:8592
type: 187.229.100.161:47611
type: 62.182.86.86:54887
type: 152.53.45.107:7081
type: 189.217.88.189:39204
type: 51.15.19.75:47902
type: 95.214.53.172:1688
type: 152.53.105.61:10240
type: 167.172.226.132:6060
type: 31.58.51.146:6932
type: 152.53.45.107:7341
type: 51.159.104.63:7731
type: 122.219.54.67:22639
type: 31.15.161.168:17191
type: 47.185.79.119:29608
type: 31.187.199.216:36785

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b8f5335b-4fef-453f-902f-a825c36b344d

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/2b51cf22da1914e8dbbf8c6becd3d2d09ae8388ea6b0d865f068cad38865b3ef

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b51cf22da1914e8dbbf8c6becd3d2d09ae8388ea6b0d865f068cad38865b3ef/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-05-26 05:56:26 UTC

File Type:

ELF64 Little (Exe)

AV detection:

16 of 38 (42.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fni46iw2dekorw57rrv6zu6s2cnoqoeou2ynqzpqndfnhcdfwpxq._file

Result

Malware family:

n/a

Score:

6/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250526-gm7jwawns4/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2b51cf22da1914e8dbbf8c6becd3d2d09ae8388ea6b0d865f068cad38865b3ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	enterpriseunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise UNIX

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 2b51cf22da1914e8dbbf8c6becd3d2d09ae8388ea6b0d865f068cad38865b3ef

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3550042/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample