MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b7956f282a26462cb27efe8722149ca521429447315720f6040adbbde3e19e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	2b7956f282a26462cb27efe8722149ca521429447315720f6040adbbde3e19e4
SHA3-384 hash:	e105ded18fbf27e5c0ef5d3af0d9a82d7652786c4d453a719e134827d838c185cd113a4650e9b79b889476112b8b18c5
SHA1 hash:	9780597c11549ce172b2f2a77e1848e2df5abf06
MD5 hash:	9704e6a2c0d8f4e8508d0422efcadc10
humanhash:	spaghetti-eight-december-comet
File name:	i686
Download:	download sample
File size:	587'764 bytes
First seen:	2025-07-09 03:50:51 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V
TLSH	T1D4C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B42869E66C
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.31951.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686de742900df8e7f868d073linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Receives data from a server

Locks files

Creates directories

Changes the time when the file was created, accessed, or modified

Creating a process from a recently created file

Opens a port

Creating a file in the %temp% directory

Collects information on the CPU

DNS request

Runs as daemon

Creating a file

Changes access rights for a written file

Sends data to a server

Connection attempt

Launching a process

Creates or modifies files in /cron to set up autorun

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

x86

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/2b7956f282a26462cb27efe8722149ca521429447315720f6040adbbde3e19e4

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 89.179.246.14:6881
type: 72.21.17.3:6881
type: 45.87.91.251:6881
type: 73.208.41.226:6881
type: 37.204.207.234:6881
type: 162.216.68.43:6881
type: 188.235.235.66:6881
type: 217.234.112.2:6881
type: 80.119.137.195:6881
type: 118.93.177.171:6881
type: 94.180.132.62:6881
type: 77.160.103.171:6881
type: 77.43.157.240:6881
type: 90.84.229.255:6881
type: 70.187.191.248:6881
type: 115.227.205.20:6881
type: 35.155.156.153:6881
type: 189.216.24.219:6881
type: 18.191.2.28:6881
type: 181.236.207.110:6881
type: 18.188.31.0:6881
type: 18.221.7.72:6881
type: 54.214.105.212:6881
type: 142.171.125.191:6881
type: 112.118.213.135:6881
type: 164.68.113.202:6881
type: 54.70.174.84:6881
type: 54.214.62.55:6881
type: 167.99.72.189:6881
type: 192.227.221.84:6881
type: 54.70.28.180:6881
type: 35.167.186.212:6881
type: 193.58.150.81:6881
type: 111.220.80.134:6881
type: 151.15.3.83:6881
type: 98.169.147.169:6881
type: 95.72.176.201:6881
type: 124.149.179.139:6881
type: 83.166.42.87:6881
type: 68.32.166.175:6881
type: 24.248.168.86:6881
type: 46.98.104.192:6881
type: 135.181.238.57:50000
type: 65.21.125.166:50000
type: 135.181.227.244:50000
type: 37.27.119.190:50000
type: 37.27.103.179:50000
type: 65.21.129.47:50000
type: 37.27.117.190:50000
type: 37.27.119.118:50000
type: 37.27.107.123:50000
type: 37.27.117.117:50000
type: 136.243.138.167:50000
type: 65.21.128.219:50000
type: 37.27.117.113:50000
type: 65.21.128.237:50000
type: 37.27.117.251:50000
type: 135.181.227.243:50000
type: 88.99.145.203:50000
type: 135.181.238.125:50000
type: 37.27.103.253:50000
type: 37.27.117.60:50000
type: 37.27.119.189:50000
type: 65.109.48.159:50000
type: 37.27.117.61:50000
type: 65.21.125.179:50000
type: 65.108.194.186:50000
type: 65.21.125.161:50000
type: 65.21.125.172:50000
type: 135.181.238.121:50000
type: 65.21.125.160:50000
type: 37.27.104.57:50000
type: 65.21.128.209:50000
type: 37.27.117.245:50000
type: 65.21.129.56:50000
type: 167.235.10.94:50000
type: 37.27.117.180:50000
type: 37.27.119.253:50000
type: 37.27.120.126:50000
type: 135.181.238.122:50000
type: 37.27.119.186:50000
type: 65.21.128.241:50000
type: 130.239.18.158:8515
type: 178.162.174.222:28014
type: 178.162.174.82:28014
type: 178.162.174.149:28001
type: 178.162.174.19:28001
type: 178.162.173.218:28001
type: 130.239.18.158:8524
type: 88.198.230.221:49668
type: 195.154.171.138:30519
type: 185.21.216.185:60731
type: 95.31.43.219:51413
type: 84.217.73.58:51413
type: 198.27.67.208:51413
type: 188.90.169.20:51413
type: 82.165.50.12:51413
type: 93.89.141.246:51413
type: 195.154.118.68:51413
type: 37.187.124.170:51413
type: 66.70.177.131:51413
type: 193.32.23.185:51413
type: 1.217.10.105:51413
type: 5.9.136.134:51413
type: 149.22.88.37:51413
type: 82.118.227.171:51413
type: 37.187.123.136:51413
type: 90.149.56.169:51413
type: 46.232.210.124:64034
type: 45.120.137.198:55094
type: 5.79.85.89:64158
type: 131.147.3.41:17179
type: 185.203.56.40:19551
type: 102.182.189.116:48327
type: 54.211.14.111:6882
type: 54.194.137.170:6882
type: 5.79.66.11:54337
type: 178.162.174.43:28007
type: 178.162.173.89:28007
type: 83.149.98.183:28007
type: 178.162.174.5:28005
type: 178.33.233.79:8999
type: 5.182.17.111:5091
type: 178.162.174.221:28000
type: 178.162.174.183:28000
type: 178.162.173.144:28000
type: 3.130.230.203:6880
type: 45.203.151.67:6880
type: 45.203.212.2:6880
type: 139.28.232.16:6880
type: 18.189.139.66:6880
type: 212.95.32.57:53117
type: 89.67.26.253:58904
type: 65.21.141.87:27602
type: 141.94.246.201:8647
type: 72.21.17.1:20023
type: 45.87.251.11:28127
type: 217.121.231.94:59625
type: 130.239.18.158:8508
type: 130.239.18.158:8521
type: 178.162.174.45:28015
type: 178.162.173.223:28015
type: 23.162.56.83:14098
type: 162.251.63.120:10068
type: 185.203.56.51:12996
type: 178.162.173.6:28008
type: 144.76.175.153:55363
type: 123.202.50.214:20578
type: 95.211.247.101:28013
type: 213.227.151.25:28013
type: 178.162.173.48:28013
type: 212.7.200.93:23999
type: 5.135.165.33:6331
type: 77.125.209.60:46180
type: 180.199.216.196:20891
type: 185.203.56.24:61827
type: 37.46.117.90:53881
type: 178.162.174.43:28004
type: 178.162.174.18:28004
type: 178.162.174.228:28004
type: 213.204.53.147:45678
type: 61.71.3.224:24658
type: 74.136.225.57:32514
type: 185.21.216.191:53853
type: 59.4.145.196:33111
type: 211.42.80.77:29318
type: 193.164.251.47:44023
type: 178.162.173.219:28002
type: 85.204.209.236:1414
type: 57.129.45.79:8652
type: 185.21.216.194:62609
type: 39.110.11.155:26301
type: 5.225.244.166:8621
type: 31.211.86.14:8621
type: 173.179.137.233:49001
type: 46.236.167.215:49001
type: 185.134.234.253:49001
type: 78.60.10.64:49001
type: 146.70.72.138:60997
type: 195.189.226.234:33617
type: 179.61.197.12:25537
type: 1.172.167.152:25395
type: 5.79.98.171:40721
type: 72.21.17.13:16103
type: 112.166.104.201:40793
type: 46.232.210.211:58079
type: 51.83.79.190:65401
type: 1.221.25.253:33105
type: 81.254.203.108:53587
type: 115.164.40.35:14316
type: 178.162.174.114:28009
type: 119.56.146.57:41014
type: 93.177.75.130:52412
type: 193.32.16.133:60742
type: 179.127.249.19:42915
type: 77.232.50.238:32390
type: 61.85.114.109:7811
type: 169.150.251.162:64068
type: 169.150.251.162:64139
type: 46.232.211.150:18759
type: 81.171.22.169:63734
type: 121.169.78.252:40851
type: 220.246.193.222:49222
type: 177.182.223.62:32555
type: 169.150.251.162:64001
type: 69.156.131.138:64216
type: 95.181.237.49:50468
type: 87.115.224.203:50321
type: 86.49.240.202:43103
type: 84.229.29.170:61793
type: 87.242.61.248:24100
type: 181.117.188.106:14230
type: 177.226.98.10:41098
type: 204.147.176.195:46633
type: 181.213.18.55:13680
type: 188.27.64.68:32424
type: 68.226.187.204:61532
type: 93.115.35.106:51985
type: 111.119.45.18:27851
type: 191.99.58.189:59053
type: 187.19.182.67:18042
type: 115.164.44.8:48082
type: 96.52.165.29:46200
type: 13.114.205.93:6892
type: 189.6.27.248:20966
type: 201.164.149.114:55814
type: 190.82.50.182:41996
type: 176.63.17.122:53005
type: 152.53.45.107:7042
type: 137.74.200.136:7931
type: 185.203.56.19:30658
type: 5.135.138.216:45203
type: 78.142.231.133:6767
type: 176.31.183.98:30008
type: 188.163.104.162:64331
type: 78.57.97.250:50943
type: 66.181.176.154:10212
type: 37.48.95.220:15073
type: 128.1.161.226:60020
type: 169.197.120.2:60020
type: 95.214.53.172:1688
type: 23.95.32.170:6969
type: 194.29.101.83:10240
type: 185.203.56.72:16237
type: 218.233.117.230:41093
type: 90.194.249.34:9089
type: 49.1.150.80:41070
type: 112.187.102.170:40802
type: 185.21.217.6:59656
type: 115.164.80.161:41888
type: 202.153.216.203:4200
type: 211.224.245.249:32998
type: 185.203.56.54:14281
type: 78.154.14.80:48568
type: 177.238.193.228:53217
type: 66.81.176.246:30618
type: 185.149.91.135:51009
type: 169.150.251.162:64057
type: 169.150.251.162:64140
type: 49.207.200.166:7204
type: 158.220.118.109:49002
type: 59.16.127.150:33037
type: 156.255.90.247:6082
type: 169.150.251.162:64026
type: 169.150.223.247:64062
type: 70.77.17.184:22664
type: 181.44.21.177:51031
type: 177.50.196.28:56201
type: 31.94.10.176:3076
type: 24.26.153.199:59671
type: 102.88.108.81:60638
type: 220.85.47.119:7722
type: 74.134.177.114:29999

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/caabc1a8-6e21-481f-a512-caaf775f4830

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e875aa07-9a13-4e5c-ad90-9c959ff205b1

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/2b7956f282a26462cb27efe8722149ca521429447315720f6040adbbde3e19e4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b7956f282a26462cb27efe8722149ca521429447315720f6040adbbde3e19e4/

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2025-07-09 03:51:25 UTC

File Type:

ELF32 Little (Exe)

AV detection:

19 of 38 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fn4vn4ucujsgfszh57uheikjzjjbikkeomkxed3aicw3xxr6dhsa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250709-eenexstmz6/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/ec153ed8-3be0-464e-8df3-803e7e642590

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/2b7956f282a26462cb27efe8722149ca521429447315720f6040adbbde3e19e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 2b7956f282a26462cb27efe8722149ca521429447315720f6040adbbde3e19e4

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558224/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample