MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32226e45de5fc5f6edd584fc05c716bd0e4ba34bf9ae28d1e9e5b01e92189af5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	32226e45de5fc5f6edd584fc05c716bd0e4ba34bf9ae28d1e9e5b01e92189af5
SHA3-384 hash:	d3a24dcca7ee4f2ee87446f0d9e0cebe609f2d70de273c9be51fa144a2c6e872e0f4c2c0299e432396372a70e0ecc65e
SHA1 hash:	894def8926755cadc99b0bcff9c3f90b76140af7
MD5 hash:	9041ea7e22b1863c1232ae9ea75de8a9
humanhash:	michigan-cold-alaska-five
File name:	mips
Download:	download sample
File size:	592'688 bytes
First seen:	2025-07-14 17:39:32 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zm:W7v+mrY2xzf03yvZ/YIG
TLSH	T105C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9
telfhash	t10ab0011070740bb84308e12d5cdcae5679f20cc3fe470c27db6047a159b54434d00d18
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Receives data from a server

Locks files

Creates directories

Opens a port

DNS request

Connection attempt

Runs as daemon

Changes access rights for a written file

Creating a file

Sends data to a server

Creating a process from a recently created file

Changes the time when the file was created, accessed, or modified

Launching a process

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

exploit gcc lolbin packed remote

Link:

https://www.filescan.io/uploads/6875412619132d98487f9f0d/reports/d2997789-3363-49af-b7bb-7cb234fe14a7/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

mips

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/32226e45de5fc5f6edd584fc05c716bd0e4ba34bf9ae28d1e9e5b01e92189af5

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 176.125.139.123:6881
type: 188.42.55.92:6881
type: 194.8.131.111:6881
type: 178.78.21.74:6881
type: 155.4.225.41:6881
type: 89.207.71.47:6881
type: 185.84.33.110:6881
type: 95.182.236.186:6881
type: 149.90.12.87:6881
type: 81.190.48.16:6881
type: 220.132.128.36:6881
type: 149.202.75.27:6881
type: 113.111.23.15:6881
type: 119.246.79.190:6881
type: 198.72.146.127:6881
type: 73.118.151.248:6881
type: 54.214.105.212:6881
type: 54.70.174.84:6881
type: 107.189.28.246:6881
type: 193.28.11.126:6881
type: 95.31.2.38:6881
type: 103.186.216.23:6881
type: 35.155.156.153:6881
type: 178.162.173.231:28001
type: 178.162.174.149:28001
type: 178.162.173.16:28001
type: 178.162.173.117:28001
type: 45.203.212.13:6880
type: 3.15.85.168:6880
type: 173.230.130.111:6880
type: 195.154.233.74:6880
type: 45.203.154.94:6880
type: 69.164.203.179:6880
type: 185.196.61.129:6880
type: 18.188.239.31:6880
type: 3.12.65.135:6880
type: 45.203.208.55:6880
type: 3.141.159.213:6880
type: 45.79.140.48:6880
type: 3.131.250.123:6880
type: 62.212.81.227:28013
type: 178.162.174.154:28013
type: 130.239.18.158:8539
type: 95.168.162.161:42670
type: 37.48.108.37:28007
type: 178.162.173.38:28007
type: 45.87.251.132:28052
type: 212.7.202.40:28035
type: 95.216.116.106:16113
type: 178.162.174.178:28003
type: 178.162.173.91:28003
type: 178.162.174.236:28003
type: 95.211.214.156:28003
type: 89.149.202.17:28003
type: 195.154.185.217:24115
type: 130.239.18.158:8516
type: 173.183.147.77:51413
type: 51.158.148.75:51413
type: 176.62.186.8:51413
type: 85.83.218.43:51413
type: 213.251.115.173:51413
type: 129.64.46.34:51413
type: 87.228.218.39:51413
type: 104.244.73.2:51413
type: 94.34.214.185:51413
type: 88.85.94.244:51413
type: 51.91.97.190:51413
type: 213.231.5.66:51413
type: 176.31.217.212:51413
type: 31.135.15.103:51413
type: 64.44.185.182:51413
type: 83.142.233.118:51413
type: 182.169.182.83:51413
type: 195.240.114.243:51413
type: 46.101.180.137:51413
type: 94.136.24.2:51413
type: 58.84.134.133:51413
type: 80.83.124.2:51413
type: 5.79.93.242:61920
type: 135.181.238.57:50000
type: 37.27.120.51:50000
type: 135.181.227.244:50000
type: 142.132.202.190:50000
type: 142.132.193.163:50000
type: 95.216.4.247:50000
type: 37.27.103.181:50000
type: 95.217.196.239:50000
type: 135.181.223.174:50000
type: 130.239.18.158:8524
type: 178.162.173.3:28010
type: 178.162.173.203:28010
type: 178.162.174.205:28010
type: 5.39.85.86:54461
type: 178.162.174.236:28005
type: 178.162.173.159:28005
type: 81.171.6.41:28008
type: 178.162.174.159:28008
type: 178.162.173.44:28008
type: 178.162.174.105:28002
type: 51.38.81.200:8657
type: 178.162.174.155:28012
type: 178.162.173.32:28012
type: 95.168.160.123:28012
type: 46.232.211.170:22909
type: 185.250.204.85:33291
type: 46.232.210.43:59944
type: 45.87.251.132:28215
type: 221.145.194.56:33364
type: 212.7.202.40:28030
type: 178.162.174.229:28009
type: 185.149.91.171:51010
type: 5.79.80.223:28014
type: 178.162.174.222:28014
type: 178.162.173.65:28011
type: 178.162.174.55:28011
type: 178.162.173.109:28011
type: 129.154.213.168:6889
type: 94.4.104.153:6889
type: 178.162.174.43:28004
type: 178.162.174.231:28004
type: 185.21.216.160:57286
type: 130.239.18.158:8515
type: 185.149.91.61:51053
type: 185.177.124.176:6890
type: 130.239.18.158:8561
type: 130.239.18.158:8537
type: 14.232.155.1:24818
type: 86.100.143.171:21108
type: 104.221.226.31:51055
type: 130.239.18.158:8580
type: 69.50.95.40:10071
type: 130.239.18.158:8597
type: 130.239.18.158:8513
type: 69.50.95.40:10063
type: 162.251.63.120:10063
type: 23.162.56.55:10098
type: 69.50.95.40:12029
type: 176.37.112.53:48894
type: 195.154.172.179:23188
type: 195.154.185.217:25051
type: 195.154.185.217:24155
type: 195.154.185.217:24263
type: 178.162.173.154:28015
type: 162.55.95.146:51555
type: 195.20.18.136:11072
type: 162.251.63.120:10034
type: 46.232.211.148:11059
type: 91.199.227.107:12247
type: 159.223.162.113:8083
type: 178.162.174.32:28000
type: 88.99.90.38:60500
type: 185.149.91.61:51063
type: 110.49.3.121:16881
type: 130.239.18.158:8538
type: 184.22.179.159:14896
type: 73.199.73.153:48555
type: 141.94.68.11:8999
type: 31.104.12.170:49001
type: 75.86.89.243:49001
type: 212.156.41.70:49001
type: 178.204.42.236:49001
type: 46.241.125.8:49001
type: 129.227.201.250:60020
type: 122.10.135.54:60020
type: 136.27.8.98:5778
type: 185.203.56.3:13983
type: 211.231.21.242:32995
type: 107.149.239.170:26113
type: 218.233.41.213:40942
type: 36.231.105.151:22392
type: 2.96.143.44:47750
type: 183.82.207.168:16732
type: 89.10.105.242:49858
type: 94.248.196.168:64919
type: 5.39.85.86:53553
type: 195.154.176.209:8642
type: 169.150.223.219:64287
type: 193.201.191.218:51414
type: 93.40.208.176:31715
type: 77.138.116.144:26504
type: 222.119.24.249:41131
type: 59.120.142.58:10861
type: 99.62.112.135:50115
type: 212.52.61.248:22789
type: 85.107.102.107:58503
type: 211.185.185.14:8048
type: 140.177.188.222:45682
type: 85.144.245.172:45682
type: 24.141.77.25:23093
type: 46.232.210.127:64024
type: 165.23.120.121:2641
type: 183.97.84.214:65339
type: 46.232.210.140:14759
type: 210.90.255.141:53520
type: 65.108.143.34:57284
type: 138.99.28.96:40213
type: 112.104.149.31:15560
type: 66.24.122.241:40707
type: 163.172.60.32:61722
type: 81.171.17.36:44990
type: 176.175.86.82:35174
type: 207.148.101.57:18452
type: 72.26.9.8:61360
type: 42.3.12.117:8249
type: 1.244.72.113:40974
type: 47.199.77.217:22019
type: 23.240.221.30:33024
type: 195.154.185.217:28221
type: 219.77.101.15:24437
type: 213.143.78.251:22690
type: 37.120.205.29:39745
type: 185.46.171.115:8617
type: 161.142.156.0:16894
type: 185.146.121.127:57658
type: 106.193.180.144:56974
type: 113.192.125.32:33158
type: 5.107.164.118:49654
type: 201.88.34.44:57208
type: 89.17.24.102:48706
type: 211.184.22.157:32875
type: 67.248.214.157:58144
type: 37.27.113.233:56691
type: 45.234.3.45:61881
type: 152.53.45.107:7242
type: 46.33.225.123:35467
type: 46.232.211.237:64394
type: 185.21.217.47:63513
type: 112.160.56.39:41189
type: 142.160.217.180:28273
type: 186.11.83.116:39631
type: 110.148.144.101:17763
type: 66.70.178.54:65018
type: 208.87.240.21:11162
type: 137.74.95.127:15809
type: 54.39.52.64:64804
type: 95.214.53.172:1688
type: 212.102.53.31:50293
type: 176.88.20.133:45323
type: 188.241.37.98:47244
type: 185.203.56.73:63208
type: 185.203.56.58:15988
type: 46.232.210.200:19359
type: 46.232.211.184:64251
type: 46.105.181.197:43337
type: 83.149.84.133:30143
type: 185.149.91.143:51111
type: 109.236.91.11:6886
type: 188.165.244.171:53502
type: 65.108.143.34:32023
type: 84.219.221.74:16473
type: 188.165.200.53:56778
type: 200.124.79.212:59767
type: 197.207.87.15:51032
type: 188.165.18.28:31353
type: 167.114.170.156:27587
type: 64.42.179.59:18995
type: 37.48.89.182:16084
type: 45.87.251.173:53942
type: 188.165.198.46:51035
type: 5.79.77.33:48210
type: 213.134.187.218:43602
type: 89.134.17.28:33208
type: 95.211.186.209:64474
type: 14.37.134.82:53426
type: 114.33.4.55:65362
type: 177.35.56.31:31952
type: 104.195.12.37:47324
type: 69.50.95.40:12012
type: 138.94.78.235:37321

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4a760e74-1399-43c1-82f5-fad720228965

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/88b0ae7d-243f-4b20-aaa1-1c13567e2729

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/32226e45de5fc5f6edd584fc05c716bd0e4ba34bf9ae28d1e9e5b01e92189af5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/32226e45de5fc5f6edd584fc05c716bd0e4ba34bf9ae28d1e9e5b01e92189af5/

Threat name:

Linux.Dropper.Multiverze

Status:

Malicious

First seen:

2025-07-14 17:40:40 UTC

File Type:

ELF32 Big (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=girg4ro6l7c7n3ovqt6alrywxuhexi2l7gxcrupj4wyb5eqytl2q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250714-v86rcsvnz7/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/788ab6e2-df47-482e-b3e4-d9bb7339e379

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.64

Link:

https://yomi.yoroi.company/submissions/32226e45de5fc5f6edd584fc05c716bd0e4ba34bf9ae28d1e9e5b01e92189af5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 32226e45de5fc5f6edd584fc05c716bd0e4ba34bf9ae28d1e9e5b01e92189af5

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558223/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample