MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 368a3241d74b6a9e5df80d5174ce50b8aa7b7a52efc980ad4611c49932f743e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 368a3241d74b6a9e5df80d5174ce50b8aa7b7a52efc980ad4611c49932f743e8 |
|---|---|
| SHA3-384 hash: | d039495959679deb80cd3d1d40b02840b78e7ad38db5d736ba37a02a3d4f4a1c6e514ffcd8f5d03abf626f6488b60c1c |
| SHA1 hash: | e103d666228783f89f109bb7b3cb4283b5146536 |
| MD5 hash: | 45df6291c7fb51fdc31374380de45e4e |
| humanhash: | oregon-papa-west-indigo |
| File name: | i686 |
| Download: | download sample |
| File size: | 587'764 bytes |
| First seen: | 2025-06-19 17:01:54 UTC |
| Last seen: | Never |
| File type: | elf |
| MIME type: | application/x-executable |
| ssdeep | 12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V |
| TLSH | T114C42241EAB7C0F2F65349320103E7BF8F33C9099165D296DB42F661EDB1B42469E66C |
| TrID | 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1) |
| Magika | elf |
| Reporter |  abuse_ch |
| Tags: | elf |
Intelligence
File Origin
# of uploads :
1
# of downloads :
63
Origin country :
DEVendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file
Creating a file in the %temp% directory
Creates directories
Sends data to a server
Creating a process from a recently created file
Changes the time when the file was created, accessed, or modified
Locks files
Collects information on the CPU
Connection attempt
Changes access rights for a written file
Launching a process
Opens a port
Runs as daemon
Receives data from a server
DNS request
Creates or modifies files in /cron to set up autorun
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Tags:
exploit gcc lolbin remote
Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
true
Architecture:
x86
Packer:
custom
Botnet:
unknown
Number of open files:
72
Number of processes launched:
10
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
Behaviour
Anti-VM
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 185.148.1.113:6881
type: 81.232.89.33:6881
type: 67.146.226.168:6881
type: 200.26.206.223:6881
type: 178.211.109.150:6881
type: 185.183.34.95:6881
type: 185.213.139.91:6881
type: 70.92.177.199:6881
type: 140.82.152.70:6881
type: 115.88.76.51:6881
type: 13.58.27.33:6881
type: 46.72.169.247:6881
type: 83.5.247.47:6881
type: 118.34.60.127:6881
type: 151.53.109.139:6881
type: 94.16.141.146:6881
type: 178.206.102.185:6881
type: 49.228.233.22:6881
type: 91.122.145.240:6881
type: 212.23.222.199:6881
type: 82.15.185.75:6881
type: 172.103.220.229:6881
type: 5.172.12.48:6881
type: 178.207.123.168:6881
type: 93.195.168.12:6881
type: 178.236.143.75:6881
type: 35.155.156.153:6881
type: 220.144.78.186:6881
type: 18.220.82.190:6881
type: 187.200.0.47:45100
type: 210.183.204.243:33201
type: 5.82.201.31:21212
type: 83.246.194.119:49001
type: 85.73.105.193:36575
type: 142.215.167.174:6882
type: 188.165.201.82:6882
type: 146.158.124.44:6882
type: 1.249.31.81:40779
type: 44.193.139.87:6880
type: 185.196.61.240:6880
type: 2.127.91.239:63568
type: 95.211.214.156:28006
type: 178.162.174.46:28006
type: 185.145.245.116:8662
type: 178.162.173.49:28011
type: 142.4.209.161:8999
type: 94.60.160.249:9592
type: 190.162.170.238:42943
type: 61.254.196.63:32855
type: 67.160.212.160:9010
type: 67.175.166.53:9010
type: 37.48.118.87:28000
type: 185.149.91.21:51114
type: 95.168.162.146:61205
type: 95.91.237.234:2419
type: 5.79.87.194:28007
type: 213.227.152.90:28007
type: 1.34.233.31:26657
type: 121.130.217.240:13783
type: 61.84.89.15:7662
type: 24.10.60.34:53562
type: 31.10.152.199:15863
type: 173.238.102.216:47817
type: 177.224.131.233:5658
type: 78.57.225.127:30425
type: 91.150.221.126:54370
type: 46.232.210.70:12209
type: 66.181.188.18:6125
type: 197.57.122.162:37679
type: 95.17.104.12:41307
type: 185.21.217.56:49152
type: 125.244.237.83:33076
type: 46.232.211.70:23059
type: 149.40.59.137:64009
type: 51.15.191.62:62945
type: 78.172.251.104:36668
type: 91.180.137.158:12793
type: 44.248.146.221:8102
type: 152.174.4.47:53129
type: 77.68.41.86:51500
type: 149.88.27.194:57112
type: 178.162.174.154:28009
type: 178.162.173.200:28005
type: 185.157.221.247:25401
type: 192.99.8.94:26325
type: 188.165.235.23:50268
type: 173.233.164.15:48887
type: 178.162.174.156:28008
type: 177.4.119.203:37688
type: 213.109.232.238:35139
type: 98.82.176.193:49164
type: 211.184.139.87:41118
type: 58.236.68.81:40930
type: 74.15.23.133:15389
type: 212.51.138.249:5678
type: 115.22.242.21:16820
type: 118.51.134.163:32753
type: 202.65.66.133:43724
type: 132.145.88.112:48181
type: 177.232.82.47:49790
type: 188.90.169.20:51413
type: 27.192.129.246:51413
type: 124.246.249.197:51413
type: 217.121.231.94:59625
type: 130.239.18.158:8508
type: 130.239.18.158:8521
type: 118.43.170.163:40733
type: 187.33.207.221:8134
type: 46.232.211.228:64135
type: 31.128.245.48:41090
type: 72.21.17.90:55072
type: 118.136.119.164:49356
type: 176.105.208.232:19557
type: 103.216.220.170:41370
type: 196.206.119.86:16287
type: 82.17.128.102:34822
type: 45.154.86.164:54058
type: 51.75.73.209:8655
type: 51.255.109.62:15671
type: 188.126.94.75:30349
type: 210.100.145.186:40767
type: 138.255.179.229:23733
type: 92.154.52.113:6889
type: 158.181.104.235:6889
type: 84.72.186.251:6889
type: 188.116.21.235:40973
type: 66.110.254.207:53859
type: 185.203.56.70:27678
type: 37.48.74.77:64614
type: 186.12.168.51:14217
type: 222.113.249.48:36361
type: 119.246.68.141:24697
type: 85.17.20.150:28002
type: 213.152.162.165:43647
type: 90.64.133.62:64901
type: 174.94.45.149:28107
type: 95.211.233.229:35460
type: 182.168.111.210:41963
type: 88.99.5.150:15262
type: 174.50.211.60:38011
type: 54.194.135.233:6892
type: 5.66.239.73:54842
type: 139.47.22.243:8464
type: 194.164.56.178:9104
type: 46.232.211.181:64196
type: 185.145.245.116:8648
type: 82.34.150.109:54535
type: 195.154.167.107:8681
type: 131.72.70.142:7430
type: 176.10.147.208:25531
type: 78.162.145.30:58387
type: 90.251.30.109:37009
type: 5.135.138.216:24402
type: 152.53.45.107:7033
type: 65.108.143.34:57003
type: 190.148.126.151:65170
type: 92.118.76.163:22865
type: 176.63.14.46:24617
type: 94.158.60.44:19606
type: 24.200.186.251:62677
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 185.148.1.113:6881
type: 81.232.89.33:6881
type: 67.146.226.168:6881
type: 200.26.206.223:6881
type: 178.211.109.150:6881
type: 185.183.34.95:6881
type: 185.213.139.91:6881
type: 70.92.177.199:6881
type: 140.82.152.70:6881
type: 115.88.76.51:6881
type: 13.58.27.33:6881
type: 46.72.169.247:6881
type: 83.5.247.47:6881
type: 118.34.60.127:6881
type: 151.53.109.139:6881
type: 94.16.141.146:6881
type: 178.206.102.185:6881
type: 49.228.233.22:6881
type: 91.122.145.240:6881
type: 212.23.222.199:6881
type: 82.15.185.75:6881
type: 172.103.220.229:6881
type: 5.172.12.48:6881
type: 178.207.123.168:6881
type: 93.195.168.12:6881
type: 178.236.143.75:6881
type: 35.155.156.153:6881
type: 220.144.78.186:6881
type: 18.220.82.190:6881
type: 187.200.0.47:45100
type: 210.183.204.243:33201
type: 5.82.201.31:21212
type: 83.246.194.119:49001
type: 85.73.105.193:36575
type: 142.215.167.174:6882
type: 188.165.201.82:6882
type: 146.158.124.44:6882
type: 1.249.31.81:40779
type: 44.193.139.87:6880
type: 185.196.61.240:6880
type: 2.127.91.239:63568
type: 95.211.214.156:28006
type: 178.162.174.46:28006
type: 185.145.245.116:8662
type: 178.162.173.49:28011
type: 142.4.209.161:8999
type: 94.60.160.249:9592
type: 190.162.170.238:42943
type: 61.254.196.63:32855
type: 67.160.212.160:9010
type: 67.175.166.53:9010
type: 37.48.118.87:28000
type: 185.149.91.21:51114
type: 95.168.162.146:61205
type: 95.91.237.234:2419
type: 5.79.87.194:28007
type: 213.227.152.90:28007
type: 1.34.233.31:26657
type: 121.130.217.240:13783
type: 61.84.89.15:7662
type: 24.10.60.34:53562
type: 31.10.152.199:15863
type: 173.238.102.216:47817
type: 177.224.131.233:5658
type: 78.57.225.127:30425
type: 91.150.221.126:54370
type: 46.232.210.70:12209
type: 66.181.188.18:6125
type: 197.57.122.162:37679
type: 95.17.104.12:41307
type: 185.21.217.56:49152
type: 125.244.237.83:33076
type: 46.232.211.70:23059
type: 149.40.59.137:64009
type: 51.15.191.62:62945
type: 78.172.251.104:36668
type: 91.180.137.158:12793
type: 44.248.146.221:8102
type: 152.174.4.47:53129
type: 77.68.41.86:51500
type: 149.88.27.194:57112
type: 178.162.174.154:28009
type: 178.162.173.200:28005
type: 185.157.221.247:25401
type: 192.99.8.94:26325
type: 188.165.235.23:50268
type: 173.233.164.15:48887
type: 178.162.174.156:28008
type: 177.4.119.203:37688
type: 213.109.232.238:35139
type: 98.82.176.193:49164
type: 211.184.139.87:41118
type: 58.236.68.81:40930
type: 74.15.23.133:15389
type: 212.51.138.249:5678
type: 115.22.242.21:16820
type: 118.51.134.163:32753
type: 202.65.66.133:43724
type: 132.145.88.112:48181
type: 177.232.82.47:49790
type: 188.90.169.20:51413
type: 27.192.129.246:51413
type: 124.246.249.197:51413
type: 217.121.231.94:59625
type: 130.239.18.158:8508
type: 130.239.18.158:8521
type: 118.43.170.163:40733
type: 187.33.207.221:8134
type: 46.232.211.228:64135
type: 31.128.245.48:41090
type: 72.21.17.90:55072
type: 118.136.119.164:49356
type: 176.105.208.232:19557
type: 103.216.220.170:41370
type: 196.206.119.86:16287
type: 82.17.128.102:34822
type: 45.154.86.164:54058
type: 51.75.73.209:8655
type: 51.255.109.62:15671
type: 188.126.94.75:30349
type: 210.100.145.186:40767
type: 138.255.179.229:23733
type: 92.154.52.113:6889
type: 158.181.104.235:6889
type: 84.72.186.251:6889
type: 188.116.21.235:40973
type: 66.110.254.207:53859
type: 185.203.56.70:27678
type: 37.48.74.77:64614
type: 186.12.168.51:14217
type: 222.113.249.48:36361
type: 119.246.68.141:24697
type: 85.17.20.150:28002
type: 213.152.162.165:43647
type: 90.64.133.62:64901
type: 174.94.45.149:28107
type: 95.211.233.229:35460
type: 182.168.111.210:41963
type: 88.99.5.150:15262
type: 174.50.211.60:38011
type: 54.194.135.233:6892
type: 5.66.239.73:54842
type: 139.47.22.243:8464
type: 194.164.56.178:9104
type: 46.232.211.181:64196
type: 185.145.245.116:8648
type: 82.34.150.109:54535
type: 195.154.167.107:8681
type: 131.72.70.142:7430
type: 176.10.147.208:25531
type: 78.162.145.30:58387
type: 90.251.30.109:37009
type: 5.135.138.216:24402
type: 152.53.45.107:7033
type: 65.108.143.34:57003
type: 190.148.126.151:65170
type: 92.118.76.163:22865
type: 176.63.14.46:24617
type: 94.158.60.44:19606
type: 24.200.186.251:62677
Status:
terminated
Behavior Graph:
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw
Score:
68 / 100
Signature
Connects to many ports of the same IP (likely port scanning)
Executes the "crontab" command typically for achieving persistence
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
ELF
Threat name:
Linux.Trojan.Multiverze
Status:
Malicious
First seen:
2025-06-19 17:02:38 UTC
File Type:
ELF32 Little (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Checks hardware identifiers (DMI)
Creates/modifies Cron job
Enumerates running processes
Reads MAC address of network interface
Reads hardware information
Renames itself
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | linux_generic_ipv6_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | ELF samples using IPv6 addresses |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
elf 368a3241d74b6a9e5df80d5174ce50b8aa7b7a52efc980ad4611c49932f743e8
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.