MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32252a6cf311b03cdfe25ce1ba008b474369e323e41d7f99f1aebbcf129ab31b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32252a6cf311b03cdfe25ce1ba008b474369e323e41d7f99f1aebbcf129ab31b
SHA3-384 hash: 20fb0e0feb5f39d2ad96b51224f196b9ca5f193057bdce3de33671cf15dfe151c2157f743871338156ca94dcfc5380b8
SHA1 hash: 69e9111779e922495ceb48e0aa031abe850e648a
MD5 hash: 3f0a5be2d1b7b1a11378632b4c45a50e
humanhash: enemy-winner-william-asparagus
File name:linux
Download: download sample
File size:2'642'600 bytes
First seen:2025-12-15 07:49:45 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 49152:dLk4TA7RByWSV4C/sqEU2Yq4fEmy6K/VUFN5Uy54PTYkx7lcb9UAfWK8yaoC8WiU:dw4TA7HyWTC/HEgdf7KNc5UogxUOUWkC
TLSH T1EEC533E3015B60BEED39D4862F0F02A2F65BE9211FE005986C11E7F0BAF9B611255777
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
33
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
expand lolbin
Link:
https://www.filescan.io/uploads/693fbdbe98941bdf1de600e5/reports/0b6ef646-744c-4646-8f33-225391708932/overview
Verdict:
Unknown
File Type:
elf.64.le
First seen:
2025-12-15T10:51:00Z UTC
Last seen:
2025-12-15T10:53:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/32252a6cf311b03cdfe25ce1ba008b474369e323e41d7f99f1aebbcf129ab31b/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/f29dbc57-e398-4a71-8867-274731e9bc16
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1832787
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1832787 Sample: linux.elf Startdate: 15/12/2025 Architecture: LINUX Score: 48 12 109.202.202.202, 80 INIT7CH Switzerland 2->12 14 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->14 16 3 other IPs or domains 2->16 18 Multi AV Scanner detection for submitted file 2->18 6 dash rm 2->6         started        8 dash rm 2->8         started        10 linux.elf 2->10         started        signatures3 process4
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/32252a6cf311b03cdfe25ce1ba008b474369e323e41d7f99f1aebbcf129ab31b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32252a6cf311b03cdfe25ce1ba008b474369e323e41d7f99f1aebbcf129ab31b/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2025-12-15 07:50:26 UTC
File Type:
ELF64 Little (Exe)
AV detection:
6 of 23 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gissu3htcgydzx7cltq3uaeli5bwtyzd4qox7gprv2546eu2wmnq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
linux upx
Link:
https://tria.ge/reports/251215-jpemzsskbz/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c4dd3501-968f-4d2d-b999-25394f6e0aa3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/32252a6cf311b03cdfe25ce1ba008b474369e323e41d7f99f1aebbcf129ab31b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 32252a6cf311b03cdfe25ce1ba008b474369e323e41d7f99f1aebbcf129ab31b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3718113/
  
Delivery method
Distributed via web download

Comments