MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 548af8d818c5cbf30efcba8a997fd4b8f331a325b6f76a0660ded4892f11f88c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	548af8d818c5cbf30efcba8a997fd4b8f331a325b6f76a0660ded4892f11f88c
SHA3-384 hash:	97561e8a5a9f113703ab67ad0613447980a97be4522593a729109db91f4b07e42bf7bda037f2d1e1b686ed89d7447d40
SHA1 hash:	59d1399bb9e78c224b6509fc93d09609ae97dc9e
MD5 hash:	522fc23e863bb060b6273098b396ce39
humanhash:	bulldog-fix-jersey-oven
File name:	amd64
Download:	download sample
File size:	482'032 bytes
First seen:	2025-06-01 12:31:22 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR
TLSH	T142A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.31951.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Siggen.9080.13887.24677.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=683c4ac4668438e362e9ba44linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates directories

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

exploit gcc lolbin remote

Link:

https://www.filescan.io/uploads/683c4827fd02ed5e059248b9/reports/cec52322-e8d9-45d0-add0-f6709aed628c/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

x86

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/548af8d818c5cbf30efcba8a997fd4b8f331a325b6f76a0660ded4892f11f88c

Behaviour

Anti-VM

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 45.154.86.83:6881
type: 88.151.91.31:6881
type: 87.253.97.232:6881
type: 86.97.68.69:6881
type: 73.164.146.248:6881
type: 5.79.67.16:6881
type: 176.97.98.115:6881
type: 219.73.116.194:6881
type: 173.89.209.75:6881
type: 94.181.134.230:6881
type: 77.51.55.26:6881
type: 176.221.6.220:6881
type: 178.183.166.202:6881
type: 176.193.231.215:6881
type: 46.138.248.66:6881
type: 63.247.211.162:6881
type: 109.226.214.101:6881
type: 157.231.30.235:6881
type: 188.187.99.27:6881
type: 217.112.15.47:6881
type: 134.209.183.166:6881
type: 94.233.57.77:6881
type: 37.133.21.45:6881
type: 178.69.209.93:6881
type: 93.4.253.15:6881
type: 188.187.36.235:6881
type: 69.201.55.45:6881
type: 80.114.127.243:6881
type: 77.100.173.167:6881
type: 220.100.126.107:6881
type: 203.218.241.132:6881
type: 97.185.176.130:6881
type: 76.83.169.12:6881
type: 145.40.240.104:6881
type: 109.248.240.104:6881
type: 94.131.118.74:6881
type: 62.199.40.74:6881
type: 106.150.239.15:6881
type: 54.70.174.84:6881
type: 85.113.193.161:6881
type: 18.191.2.28:6881
type: 212.28.178.141:6881
type: 31.44.56.53:6881
type: 185.148.103.149:6881
type: 18.218.241.3:6881
type: 51.15.20.12:6881
type: 141.98.154.145:6881
type: 178.224.255.161:6881
type: 54.70.28.180:6881
type: 119.28.55.240:6881
type: 146.158.76.19:6881
type: 188.227.96.23:6881
type: 46.248.73.3:6881
type: 188.244.34.66:6881
type: 100.78.17.34:6881
type: 85.207.251.72:6881
type: 139.162.168.10:6881
type: 46.27.211.63:6881
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 45.203.155.73:6880
type: 154.202.132.194:6880
type: 52.71.188.191:6880
type: 195.154.233.74:6880
type: 45.203.212.18:6880
type: 178.162.174.43:28004
type: 178.162.174.88:28004
type: 178.162.173.85:28004
type: 178.162.173.194:28005
type: 178.162.174.74:28005
type: 178.162.174.226:28005
type: 23.162.56.55:10048
type: 45.152.210.34:50171
type: 5.79.80.223:28014
type: 83.149.98.184:28014
type: 178.162.173.194:28014
type: 69.50.95.40:10099
type: 37.48.95.144:22736
type: 130.239.18.158:8580
type: 80.78.26.245:13505
type: 178.162.174.171:28009
type: 162.55.84.206:50000
type: 65.21.125.159:50000
type: 37.27.119.182:50000
type: 144.76.72.91:50000
type: 178.162.174.34:28001
type: 62.212.81.233:28001
type: 195.154.170.6:8682
type: 185.149.91.139:51009
type: 89.149.202.13:28013
type: 142.215.167.169:6882
type: 212.192.42.172:6882
type: 94.23.215.83:6882
type: 142.215.164.106:6882
type: 188.165.201.120:6882
type: 94.242.45.19:64645
type: 146.70.142.89:42982
type: 178.162.173.91:28003
type: 5.39.85.82:55428
type: 200.69.42.130:22173
type: 89.67.70.124:51413
type: 66.190.51.115:51413
type: 83.174.44.78:51413
type: 5.135.155.133:51413
type: 93.51.18.111:51413
type: 18.232.197.8:51413
type: 135.181.139.47:51413
type: 213.158.1.85:51413
type: 221.71.150.199:51413
type: 95.217.36.162:51413
type: 162.19.243.205:51413
type: 95.31.211.47:51413
type: 37.192.146.147:51413
type: 113.116.35.110:51413
type: 90.16.253.158:51413
type: 95.211.194.52:51413
type: 95.31.226.0:51413
type: 91.115.241.33:51413
type: 46.105.60.156:51413
type: 95.211.194.40:51413
type: 185.170.115.214:51413
type: 185.203.56.50:61573
type: 185.183.35.103:6884
type: 193.233.202.201:6884
type: 82.79.181.233:39277
type: 114.80.9.31:6891
type: 51.75.78.69:6891
type: 23.158.56.120:14098
type: 51.75.77.134:8650
type: 212.7.202.40:28027
type: 178.162.173.194:28000
type: 178.162.173.223:28000
type: 185.203.56.38:31318
type: 178.162.173.144:28007
type: 178.162.174.102:28007
type: 37.48.111.172:49171
type: 185.149.91.171:51073
type: 31.135.226.182:8202
type: 93.81.245.242:16656
type: 46.151.155.34:1139
type: 46.188.120.221:2069
type: 5.165.134.181:8621
type: 84.215.15.76:8621
type: 86.124.142.90:8621
type: 176.65.49.153:8621
type: 130.239.18.158:8508
type: 130.239.18.158:8521
type: 178.162.173.163:28006
type: 213.227.152.133:28006
type: 51.159.104.76:7186
type: 83.253.121.47:38474
type: 178.33.233.79:8999
type: 195.201.179.130:16309
type: 130.239.18.158:8500
type: 130.239.18.158:8516
type: 130.239.18.158:8513
type: 185.203.56.1:16053
type: 178.162.174.77:28012
type: 188.129.83.180:12825
type: 188.165.200.90:56466
type: 118.107.220.15:23557
type: 89.10.239.29:56176
type: 213.227.152.142:28002
type: 114.34.138.206:51417
type: 89.149.202.17:28056
type: 185.149.91.15:51023
type: 124.96.174.3:14594
type: 213.34.235.106:6889
type: 161.81.19.77:6889
type: 81.246.191.178:6889
type: 211.1.207.158:6889
type: 93.70.211.146:6889
type: 154.60.195.66:6889
type: 74.69.114.165:6889
type: 194.76.127.247:57240
type: 92.255.247.184:33070
type: 95.55.175.199:31297
type: 13.59.64.64:7191
type: 221.151.148.53:8681
type: 46.172.31.26:49001
type: 45.184.74.0:53254
type: 67.164.78.151:43248
type: 84.27.255.189:61918
type: 5.79.78.96:62930
type: 37.187.98.127:31415
type: 169.150.223.217:64140
type: 218.102.144.23:41113
type: 176.119.22.8:1129
type: 41.102.81.242:37603
type: 115.127.49.250:20498
type: 71.206.54.191:18403
type: 88.167.198.103:34033
type: 46.10.148.122:34033
type: 50.68.52.59:11851
type: 178.214.253.28:27556
type: 67.164.221.241:57463
type: 176.114.190.166:1798
type: 78.154.15.33:51248
type: 62.210.124.210:28331
type: 122.199.34.37:49160
type: 68.33.169.47:45185
type: 190.33.19.110:53734
type: 213.102.69.164:19588
type: 162.120.142.149:19969
type: 122.199.50.134:36731
type: 46.232.210.124:64088
type: 116.14.56.242:28453
type: 82.0.57.160:45838
type: 92.236.197.188:14082
type: 150.107.174.123:45217
type: 178.162.173.3:28010
type: 46.232.210.10:16409
type: 178.162.174.225:28008
type: 178.162.173.232:28008
type: 45.137.83.149:55935
type: 185.21.216.137:58403
type: 207.6.166.200:53467
type: 36.13.176.213:22314
type: 77.98.113.137:62260
type: 78.57.64.251:14405
type: 213.82.70.199:64266
type: 212.232.75.31:15277
type: 188.165.200.90:56912
type: 184.22.234.133:58178
type: 161.230.114.152:61875
type: 84.23.47.35:18416
type: 2.59.17.220:41589
type: 212.225.184.27:44711
type: 195.170.172.38:10240
type: 194.29.101.83:10240
type: 152.53.52.107:10240
type: 146.59.3.81:10240
type: 152.53.104.128:10240
type: 189.113.193.161:52411
type: 45.131.79.43:64078
type: 177.223.34.216:33674
type: 13.114.205.93:6892
type: 185.149.91.131:51047
type: 185.149.91.33:51025
type: 188.167.251.216:25071
type: 75.172.56.53:17105
type: 54.77.218.23:6992
type: 167.179.188.177:64961
type: 79.119.22.144:17670
type: 185.203.56.37:58549
type: 89.133.47.174:51821
type: 51.195.222.183:8645
type: 66.70.178.54:10517
type: 213.231.178.167:17159
type: 54.39.52.64:29129
type: 188.76.112.53:6898
type: 152.53.45.107:7342
type: 24.186.203.84:63265
type: 54.39.52.64:48853
type: 212.132.230.132:12842
type: 194.183.188.71:50741
type: 5.39.80.197:51513
type: 166.88.231.29:29646
type: 95.145.78.220:13071
type: 212.5.142.54:30182
type: 185.200.117.131:60832
type: 178.90.227.106:40549
type: 5.135.178.12:53349
type: 72.21.17.102:30621
type: 66.181.182.99:17053
type: 24.204.146.173:11824
type: 83.143.114.230:9089
type: 176.234.131.216:21032
type: 176.63.29.47:5875
type: 93.114.96.241:52719
type: 213.130.78.75:7333
type: 177.223.32.59:21885
type: 135.181.132.204:50260
type: 114.10.16.212:16662
type: 38.142.119.234:51000
type: 64.46.24.137:7037
type: 78.142.231.133:6767
type: 178.35.99.208:29088
type: 46.232.211.221:64299
type: 176.63.1.38:7163
type: 219.77.70.22:26324
type: 188.165.231.168:50951
type: 109.198.226.66:4378
type: 152.53.45.107:6987
type: 167.172.226.132:6060
type: 61.93.59.168:18068
type: 81.111.159.219:57362
type: 126.234.212.122:13476
type: 71.236.209.194:29830
type: 212.5.142.98:17343
type: 101.1.139.79:17581
type: 45.154.86.83:54413
type: 176.213.186.190:54979
type: 86.58.111.149:12781

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/7d1853ab-e689-4634-bdc3-893c2a201e1f

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/548af8d818c5cbf30efcba8a997fd4b8f331a325b6f76a0660ded4892f11f88c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/548af8d818c5cbf30efcba8a997fd4b8f331a325b6f76a0660ded4892f11f88c/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2025-06-01 12:33:24 UTC

File Type:

ELF64 Little (Exe)

AV detection:

15 of 38 (39.47%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ksfprwayyxf7gdx4xkfjs76uxdztdizfw33wubta33kislyr7cga._file

Result

Malware family:

n/a

Score:

8/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250601-pqzbnsxlz3/

Behaviour

Command and Scripting Interpreter: Unix Shell

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Executes dropped EXE

Contacts a large (524) amount of remote hosts

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e453cc29-914c-4782-a4d1-649966afd8fa

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/548af8d818c5cbf30efcba8a997fd4b8f331a325b6f76a0660ded4892f11f88c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	enterpriseunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise UNIX

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 548af8d818c5cbf30efcba8a997fd4b8f331a325b6f76a0660ded4892f11f88c

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3550042/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample