MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39ee270a4a1e9bd606a7a452da0745ea863b318eb88e47f9fae4aff9c832b865. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	39ee270a4a1e9bd606a7a452da0745ea863b318eb88e47f9fae4aff9c832b865
SHA3-384 hash:	77f1553755015bead0c6d6134d689a767d55e6ffb6a863f0edc3bb201bb3939823e0114aade07cc2734f1504dc87cae4
SHA1 hash:	fb619b529cf93df23eae7a9d643e28306d394605
MD5 hash:	7b676c89f1bb2017a26e3e58f5578a62
humanhash:	twenty-charlie-mike-kansas
File name:	i686
Download:	download sample
File size:	587'764 bytes
First seen:	2025-06-10 21:52:15 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V
TLSH	T16DC42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.31951.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6848a91c07b5e8c1cfe6317dlinux22vpnfull_triage

Tags:

shellcode

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Creating a process from a recently created file

Changes access rights for a written file

Creates directories

DNS request

Changes the time when the file was created, accessed, or modified

Creating a file in the %temp% directory

Launching a process

Sends data to a server

Opens a port

Creating a file

Locks files

Receives data from a server

Runs as daemon

Collects information on the CPU

Creates or modifies files in /cron to set up autorun

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

x86

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/39ee270a4a1e9bd606a7a452da0745ea863b318eb88e47f9fae4aff9c832b865

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 178.69.209.93:6881
type: 89.222.145.151:6881
type: 42.228.40.151:6881
type: 95.66.217.20:6881
type: 176.221.5.99:6881
type: 37.83.117.44:6881
type: 84.196.157.149:6881
type: 146.212.51.196:6881
type: 87.98.162.88:6881
type: 91.222.155.239:6881
type: 176.193.231.215:6881
type: 86.97.68.69:6881
type: 63.247.211.162:6881
type: 178.32.217.211:6881
type: 84.147.74.154:6881
type: 89.207.71.47:6881
type: 188.42.55.92:6881
type: 85.215.59.222:6881
type: 31.210.201.14:6881
type: 83.251.1.5:6881
type: 37.110.133.237:6881
type: 76.30.50.67:6881
type: 87.205.111.232:6881
type: 201.4.175.151:6881
type: 101.141.111.27:6881
type: 95.160.125.99:6881
type: 77.54.253.145:6881
type: 181.229.103.61:6881
type: 109.254.15.245:6881
type: 95.191.18.3:6881
type: 189.101.2.174:6881
type: 95.87.237.30:6881
type: 169.150.196.34:6881
type: 174.26.228.83:6881
type: 192.99.3.72:6881
type: 54.70.174.84:6881
type: 41.75.209.2:6881
type: 54.194.124.68:6881
type: 54.194.137.170:6881
type: 105.103.49.136:6881
type: 18.218.241.3:6881
type: 35.167.186.212:6881
type: 18.220.82.190:6881
type: 217.29.139.67:6881
type: 13.58.27.33:6881
type: 35.163.251.58:6881
type: 5.138.214.71:6881
type: 54.70.28.180:6881
type: 39.43.176.56:6881
type: 206.116.69.201:6881
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 178.162.174.222:28014
type: 178.162.174.77:28014
type: 178.162.173.90:28014
type: 178.162.173.166:28014
type: 45.203.212.2:6880
type: 18.213.98.90:6880
type: 3.141.159.213:6880
type: 3.12.65.135:6880
type: 148.153.170.2:6880
type: 195.154.233.74:6880
type: 3.130.230.203:6880
type: 173.230.130.111:6880
type: 148.153.188.242:6880
type: 45.203.151.67:6880
type: 45.203.206.46:6880
type: 45.203.208.35:6880
type: 217.15.157.189:6915
type: 135.181.238.57:50000
type: 37.27.103.181:50000
type: 37.27.107.119:50000
type: 142.132.203.56:50000
type: 142.132.206.120:50000
type: 37.27.117.252:50000
type: 37.27.119.125:50000
type: 178.162.174.43:28004
type: 178.162.174.227:28004
type: 178.162.174.228:28004
type: 178.162.174.70:28004
type: 188.166.98.93:51413
type: 86.215.78.58:51413
type: 90.188.6.58:51413
type: 51.158.148.75:51413
type: 45.154.86.160:51413
type: 37.187.20.193:51413
type: 138.199.27.226:51413
type: 213.178.38.41:51413
type: 119.164.125.109:51413
type: 61.165.12.134:51413
type: 74.12.45.5:51413
type: 125.49.82.4:51413
type: 158.174.113.139:51413
type: 95.211.197.110:51413
type: 94.210.243.170:51413
type: 193.19.211.141:51413
type: 176.9.70.139:51413
type: 59.60.158.28:51413
type: 95.108.30.63:51413
type: 64.226.93.20:51413
type: 37.157.196.59:51413
type: 178.124.193.198:51413
type: 80.249.114.242:51413
type: 220.146.228.183:51413
type: 163.172.159.100:51413
type: 87.202.85.23:51413
type: 37.187.112.31:51413
type: 185.107.71.103:44737
type: 5.39.94.219:45467
type: 130.239.18.158:8580
type: 88.132.161.239:45889
type: 130.239.18.158:8500
type: 23.158.56.120:10040
type: 65.108.143.34:36801
type: 178.162.173.146:28006
type: 185.200.116.131:22025
type: 95.25.155.227:48236
type: 92.125.60.169:29878
type: 153.165.90.11:53078
type: 81.187.39.235:8957
type: 69.50.95.40:10020
type: 172.111.38.128:10090
type: 77.247.181.209:44230
type: 62.112.10.81:6889
type: 79.187.163.245:6889
type: 195.213.91.148:6889
type: 194.29.182.205:6889
type: 178.71.249.201:6889
type: 51.75.73.209:8657
type: 185.149.91.141:51083
type: 178.162.174.31:28003
type: 178.162.173.105:28003
type: 178.162.173.91:28003
type: 178.162.174.178:28003
type: 23.158.56.120:26096
type: 195.201.179.130:16309
type: 130.239.18.158:8516
type: 130.239.18.158:8513
type: 185.203.56.51:12996
type: 178.162.173.6:28008
type: 178.162.173.156:28008
type: 83.149.84.32:28008
type: 188.165.198.46:54404
type: 189.113.8.254:36703
type: 89.149.202.13:28035
type: 91.122.34.149:51415
type: 178.162.173.231:28001
type: 178.162.174.47:28001
type: 130.239.18.158:8539
type: 85.174.129.222:19270
type: 91.199.227.109:10703
type: 46.232.211.148:11209
type: 81.171.20.66:64010
type: 178.162.173.172:28009
type: 46.232.210.175:29809
type: 37.48.89.181:48531
type: 178.162.173.141:28000
type: 178.162.174.143:28000
type: 178.162.174.234:28000
type: 178.162.174.228:28007
type: 178.162.174.46:28013
type: 37.48.71.178:28013
type: 37.48.118.38:28013
type: 185.203.56.68:62927
type: 172.96.121.2:6884
type: 178.162.174.45:28015
type: 45.149.235.223:26159
type: 114.34.138.206:51417
type: 153.198.252.86:7897
type: 81.171.22.224:51501
type: 195.154.178.158:8671
type: 51.158.148.71:57487
type: 154.70.31.249:34066
type: 178.84.175.166:28128
type: 31.8.189.235:49001
type: 159.224.116.160:49001
type: 79.111.156.113:43995
type: 191.217.160.249:49129
type: 31.112.24.94:27801
type: 95.168.168.217:62329
type: 95.168.162.182:27330
type: 150.9.19.167:12321
type: 51.112.110.177:20895
type: 185.203.56.35:65262
type: 119.106.33.189:7844
type: 119.192.210.49:41101
type: 75.97.228.159:30350
type: 61.93.71.224:27183
type: 222.7.204.206:26381
type: 5.39.85.155:54190
type: 78.182.158.53:25407
type: 142.118.148.95:53227
type: 112.162.187.2:40799
type: 188.165.250.70:52218
type: 37.48.70.168:45812
type: 111.254.16.253:13400
type: 211.193.120.41:41143
type: 121.188.170.189:40802
type: 161.97.82.46:60144
type: 73.240.67.136:65036
type: 109.51.72.164:18439
type: 109.126.32.241:1545
type: 45.190.119.172:47560
type: 175.215.147.98:40852
type: 181.71.136.226:19331
type: 201.131.106.217:12319
type: 73.146.175.127:50324
type: 69.180.62.98:6590
type: 69.163.46.31:17182
type: 89.134.28.106:4205
type: 213.230.92.106:48353
type: 31.162.84.55:43802
type: 98.57.187.18:27662
type: 109.252.113.170:2660
type: 131.0.205.182:33539
type: 213.227.151.117:12770
type: 142.162.203.5:56253
type: 70.81.200.165:26267
type: 54.211.14.111:20873
type: 95.188.94.57:30412
type: 109.182.56.100:53072
type: 95.179.52.172:35121
type: 181.41.150.55:10248
type: 65.108.143.34:39657
type: 95.25.208.248:52270
type: 83.199.131.94:15405
type: 5.15.74.83:20482
type: 185.184.106.251:12596
type: 5.15.74.83:25236
type: 178.187.162.164:48618
type: 217.70.28.106:41901
type: 93.35.37.67:41984
type: 85.243.101.67:44111
type: 197.203.17.2:47925
type: 95.27.48.56:2576
type: 54.77.218.23:6892
type: 72.21.17.21:30698
type: 79.79.217.95:47369
type: 83.239.242.120:2177
type: 151.234.202.209:58850
type: 65.87.241.136:34398
type: 152.53.104.128:10240
type: 195.170.172.38:10240
type: 188.163.68.91:22668
type: 213.248.13.80:5351
type: 101.191.86.250:44625
type: 23.158.56.120:14066
type: 175.132.120.43:20604
type: 54.39.52.64:40452
type: 46.232.210.20:13759
type: 72.21.17.73:64237
type: 216.39.248.235:6933
type: 149.56.27.121:58813
type: 54.39.107.165:22278
type: 137.74.200.136:32882
type: 213.227.152.142:28002
type: 78.154.15.232:13285
type: 185.93.182.171:46668
type: 207.188.168.68:8999
type: 185.162.184.34:60658
type: 5.79.77.69:50498
type: 85.187.82.210:20263
type: 46.232.210.80:17859
type: 104.220.56.210:15560
type: 109.241.131.92:49413
type: 126.25.81.236:24798
type: 185.145.245.116:8664
type: 185.21.217.49:57347
type: 79.137.16.146:47969
type: 45.156.188.45:12828
type: 51.159.53.22:51414
type: 185.149.91.31:51523
type: 195.154.185.217:26527
type: 221.158.61.195:7822
type: 121.168.234.251:40980
type: 85.198.105.116:15137
type: 101.191.176.191:50052
type: 130.61.172.11:54883
type: 92.247.236.228:44444
type: 37.48.95.132:43123
type: 46.232.210.73:64114
type: 3.87.44.204:20965
type: 169.150.223.237:64194

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/403375a2-530f-4f0f-81e1-bc359ea2c574

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/39ee270a4a1e9bd606a7a452da0745ea863b318eb88e47f9fae4aff9c832b865

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/39ee270a4a1e9bd606a7a452da0745ea863b318eb88e47f9fae4aff9c832b865/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-06-10 21:53:24 UTC

File Type:

ELF32 Little (Exe)

AV detection:

12 of 36 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hhxcocskd2n5mbvhurjnub2f5kddwmmoxchep6p24sx7tsbsxbsq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250610-1q8qwsgj6s/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5c7f3098-898c-46ca-a7f9-d817b4b74582

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/39ee270a4a1e9bd606a7a452da0745ea863b318eb88e47f9fae4aff9c832b865

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 39ee270a4a1e9bd606a7a452da0745ea863b318eb88e47f9fae4aff9c832b865

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558224/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample