MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b873dd491892341a0d4cd19d63be3b93a648a0c172e2167b1bec4ccdbeceb80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	5b873dd491892341a0d4cd19d63be3b93a648a0c172e2167b1bec4ccdbeceb80
SHA3-384 hash:	50f2c2cd82c496189f889b90ea8ca841750ef3abf9cc14ec61047d3c623a5f865f5d34a86e0f8b98c0062fd357a1c7af
SHA1 hash:	c5f698daf5b385a67138d80fcea79d7112dd4216
MD5 hash:	68db30722468a749d35a654cfda65b4a
humanhash:	freddie-blossom-oregon-hawaii
File name:	i686
Download:	download sample
File size:	587'764 bytes
First seen:	2025-06-27 16:54:20 UTC
Last seen:	2025-06-28 07:06:56 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V
TLSH	T1D3C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B42469E66C
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.31951.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Siggen.9095.796.31409.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685ecd0d0fceda814b468e49linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Sends data to a server

Changes the time when the file was created, accessed, or modified

Opens a port

DNS request

Connection attempt

Locks files

Changes access rights for a written file

Creating a process from a recently created file

Launching a process

Collects information on the CPU

Receives data from a server

Creates directories

Creating a file in the %temp% directory

Runs as daemon

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

base64 exploit gcc lolbin remote

Link:

https://www.filescan.io/uploads/685eccd045e80b29f8a218cb/reports/45d7e093-4936-440c-91b7-91c059b9a11b/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

x86

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/5b873dd491892341a0d4cd19d63be3b93a648a0c172e2167b1bec4ccdbeceb80

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 188.42.55.92:6881
type: 158.101.222.252:6881
type: 178.69.209.93:6881
type: 78.30.251.63:6881
type: 176.221.4.158:6881
type: 37.204.207.234:6881
type: 199.68.120.93:6881
type: 178.32.217.211:6881
type: 95.78.211.149:6881
type: 51.159.76.32:6881
type: 212.108.197.140:6881
type: 37.194.55.75:6881
type: 79.118.170.190:6881
type: 178.207.172.48:6881
type: 109.198.191.19:6881
type: 185.48.61.207:6881
type: 91.201.150.189:6881
type: 54.193.33.181:6881
type: 185.186.197.211:6881
type: 176.125.139.123:6881
type: 89.207.71.47:6881
type: 81.167.102.168:6881
type: 176.192.215.139:6881
type: 64.121.4.98:6881
type: 79.50.110.192:6881
type: 185.193.226.160:6881
type: 94.62.241.136:6881
type: 152.165.56.116:6881
type: 220.148.248.101:6881
type: 218.103.246.106:6881
type: 149.90.177.78:6881
type: 182.164.129.250:6881
type: 84.255.218.113:6881
type: 107.173.127.249:6881
type: 148.135.106.206:6881
type: 54.70.174.84:6881
type: 186.7.204.243:6881
type: 51.15.20.12:6881
type: 139.162.168.10:6881
type: 141.98.154.145:6881
type: 35.167.186.212:6881
type: 93.48.192.48:6881
type: 54.214.62.55:6881
type: 221.251.240.250:6881
type: 210.6.57.179:6881
type: 188.165.222.79:6881
type: 80.221.247.219:6881
type: 18.220.82.190:6881
type: 91.218.84.46:6881
type: 77.37.169.119:6881
type: 51.190.189.29:6881
type: 1.34.90.99:6881
type: 178.162.173.231:28001
type: 178.162.173.201:28001
type: 178.162.173.96:28001
type: 178.162.174.178:28003
type: 178.162.174.236:28003
type: 178.162.174.233:28003
type: 178.162.173.105:28003
type: 5.79.102.5:28003
type: 173.230.130.111:6880
type: 52.71.6.82:6880
type: 45.203.212.13:6880
type: 3.130.230.203:6880
type: 45.203.151.81:6880
type: 154.202.132.183:6880
type: 45.203.154.94:6880
type: 3.15.85.168:6880
type: 148.153.170.2:6880
type: 95.168.162.161:42670
type: 212.7.202.40:28035
type: 142.132.193.163:50000
type: 142.132.202.190:50000
type: 142.132.193.164:50000
type: 142.132.206.120:50000
type: 135.181.223.211:50000
type: 135.181.227.244:50000
type: 135.181.238.57:50000
type: 37.27.119.254:50000
type: 144.76.76.3:50000
type: 37.27.119.124:50000
type: 95.216.3.151:50000
type: 142.132.197.33:50000
type: 148.251.79.107:50000
type: 148.251.123.231:50000
type: 95.216.13.110:50000
type: 95.217.86.221:50000
type: 5.9.86.148:50000
type: 37.27.107.125:50000
type: 37.27.120.51:50000
type: 144.76.220.196:50000
type: 178.162.173.38:28007
type: 81.171.7.65:28007
type: 178.162.174.46:28007
type: 185.203.56.7:63571
type: 178.162.174.111:28000
type: 213.227.152.133:28000
type: 72.21.17.84:51983
type: 23.158.56.120:14084
type: 23.158.56.120:16087
type: 69.50.95.40:10081
type: 178.162.174.228:28012
type: 178.162.174.141:28012
type: 178.162.173.213:28015
type: 178.162.173.232:28008
type: 178.162.173.6:28008
type: 69.50.95.40:12053
type: 185.203.56.51:12996
type: 185.21.216.193:55966
type: 130.239.18.158:8524
type: 155.4.131.44:59037
type: 37.97.250.33:51413
type: 31.45.31.41:51413
type: 176.31.105.75:51413
type: 112.74.104.111:51413
type: 84.220.211.193:51413
type: 31.20.182.114:51413
type: 95.168.174.173:51413
type: 178.70.30.2:51413
type: 70.94.243.13:51413
type: 221.241.9.229:51413
type: 45.152.209.99:51413
type: 51.158.154.92:51413
type: 51.222.9.201:51413
type: 85.232.130.187:51413
type: 103.200.92.162:51413
type: 70.78.197.110:51413
type: 212.111.95.158:51413
type: 5.79.73.164:51413
type: 147.124.212.152:51413
type: 118.240.106.52:51413
type: 15.235.82.46:47265
type: 5.196.7.57:50722
type: 178.162.173.160:28013
type: 62.212.81.227:28013
type: 178.162.174.147:28013
type: 178.162.173.145:28016
type: 67.218.240.102:14921
type: 220.132.179.42:59228
type: 79.106.231.163:1434
type: 67.220.85.41:11907
type: 178.162.174.222:28014
type: 178.162.174.43:28004
type: 130.239.18.158:8515
type: 23.162.56.55:10071
type: 185.149.91.167:51073
type: 172.96.121.2:6884
type: 72.21.17.101:63130
type: 91.199.227.113:10544
type: 185.203.56.50:59141
type: 5.79.66.11:54337
type: 46.232.211.167:13109
type: 23.162.56.55:10074
type: 178.162.173.154:28010
type: 178.162.173.111:28010
type: 185.203.56.73:17490
type: 67.220.85.98:46919
type: 46.232.211.245:58303
type: 178.162.174.155:28006
type: 5.79.83.114:28006
type: 89.67.73.128:8083
type: 185.250.204.85:33291
type: 46.232.210.43:59944
type: 45.87.251.132:28215
type: 212.7.202.40:28030
type: 212.7.200.120:43955
type: 92.222.217.68:54272
type: 45.87.251.132:28143
type: 46.232.210.90:23609
type: 178.162.173.160:28005
type: 130.239.18.158:8539
type: 36.225.79.62:13886
type: 86.144.84.49:19178
type: 212.164.222.170:36002
type: 142.119.127.203:45698
type: 87.219.14.138:49001
type: 95.105.71.22:23783
type: 45.131.79.79:64109
type: 46.63.219.191:22331
type: 134.19.179.211:25658
type: 194.44.57.85:48635
type: 159.224.185.190:6889
type: 58.172.0.154:6889
type: 61.18.230.51:6889
type: 116.49.238.228:6889
type: 93.49.3.195:6889
type: 1.36.58.21:6889
type: 69.156.126.241:6889
type: 47.144.93.107:16449
type: 89.203.49.10:58964
type: 1.160.12.86:8318
type: 79.98.150.150:6200
type: 76.147.164.25:13512
type: 45.86.187.175:3247
type: 94.4.104.178:50367
type: 213.227.246.195:17686
type: 101.127.46.121:13281
type: 74.215.113.118:1151
type: 27.59.115.150:6148
type: 172.86.106.65:9773
type: 195.154.172.179:26504
type: 118.195.207.13:15000
type: 183.130.171.220:15000
type: 123.207.55.228:15000
type: 68.69.168.2:59427
type: 89.149.197.198:34377
type: 93.170.171.149:40308
type: 191.106.226.255:30722
type: 87.227.73.126:64091
type: 187.225.3.50:41725
type: 188.18.244.48:2823
type: 79.125.172.34:50018
type: 189.251.234.245:23788
type: 5.238.217.42:19308
type: 185.145.245.116:8646
type: 176.230.105.117:40908
type: 123.194.97.88:24840
type: 176.31.183.108:51151
type: 185.203.56.42:12668
type: 77.246.103.4:37772
type: 158.174.12.219:9716
type: 212.164.39.255:18964
type: 88.97.202.36:6430
type: 170.0.222.109:41785
type: 85.174.19.69:39800
type: 178.46.63.247:44381
type: 62.1.168.231:27918
type: 149.56.27.121:58813
type: 54.39.52.64:13832
type: 78.142.231.133:6767
type: 168.0.205.97:18333
type: 130.239.18.158:8500
type: 85.223.51.71:3627
type: 77.79.179.71:15406
type: 98.0.16.98:49720
type: 157.157.71.80:25622
type: 152.228.162.85:42435
type: 23.158.56.120:16067
type: 197.2.91.18:55907
type: 51.15.19.75:3063
type: 185.149.91.61:51035
type: 195.170.172.38:10240
type: 94.23.215.83:6882
type: 188.165.201.120:6882
type: 46.232.211.210:25409
type: 192.3.211.98:22318
type: 106.139.123.86:7014
type: 154.67.148.126:61804
type: 60.110.121.94:20391
type: 121.156.89.133:40000
type: 24.78.241.109:44505
type: 138.64.212.114:59724
type: 201.15.242.80:18626
type: 27.83.189.62:13980
type: 89.64.64.38:12403
type: 67.222.246.118:40915
type: 185.15.63.13:2750
type: 85.153.226.90:26576
type: 77.169.38.156:64020
type: 95.90.205.22:4699
type: 47.224.96.74:52123
type: 202.187.3.24:18121
type: 81.165.173.23:62342
type: 37.200.77.130:51414
type: 37.63.94.182:61995
type: 85.114.199.203:57729
type: 178.162.174.168:28009
type: 57.129.45.78:8655
type: 65.108.143.34:36610
type: 37.228.239.171:14482
type: 81.243.123.16:14729
type: 94.215.28.133:37136

Result

Verdict:

MALICIOUS

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a43cc2b4-271a-4da6-bab7-7f187a304fe1

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/8639f169-f322-4e4a-bcdd-775b662bd46a

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/5b873dd491892341a0d4cd19d63be3b93a648a0c172e2167b1bec4ccdbeceb80

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5b873dd491892341a0d4cd19d63be3b93a648a0c172e2167b1bec4ccdbeceb80/

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2025-06-27 16:54:33 UTC

File Type:

ELF32 Little (Exe)

AV detection:

19 of 38 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lodt3verrerudiguzum5mo7dxe5gjcqmc4xccz5rx3cmzw7m5oaa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250627-vesmmsar8w/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/bde3d2c3-afd4-4b69-908e-b2bab216064c

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5b873dd491892341a0d4cd19d63be3b93a648a0c172e2167b1bec4ccdbeceb80

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 5b873dd491892341a0d4cd19d63be3b93a648a0c172e2167b1bec4ccdbeceb80

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558224/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample