MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 626ae1e3432bf24202a6a32f0971b3ceaefd75dee344d772762c52804c2f8016. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 626ae1e3432bf24202a6a32f0971b3ceaefd75dee344d772762c52804c2f8016
SHA3-384 hash: b2acf1bf35ab26aae517e9aa4f51e6435893e8aa5bc5ce6521f6693ddb5ea0d072daad6bad9c7b1720a685d50691c664
SHA1 hash: 4f58a7aa7fbbc9f032e7097cacd255115b3986fe
MD5 hash: 8f0e53ba410305c27555b46106c4d32b
humanhash: spring-crazy-wyoming-louisiana
File name:amd64
Download: download sample
File size:482'032 bytes
First seen:2025-05-27 09:45:53 UTC
Last seen:2025-05-27 13:30:52 UTC
File type: elf
MIME type:application/x-executable
ssdeep 12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR
TLSH T1C2A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
2
# of downloads :
74
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Siggen.9080.23243.23842.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68358b91acf88f5815e78acelinux22vpnfull_triage
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creates directories
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
exploit gcc lolbin remote
Link:
https://www.filescan.io/uploads/683589e9e336a33801dec22f/reports/27c46401-1bff-4b59-b10d-527d94cfada8/overview
Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
true
Architecture:
x86
Packer:
custom
Botnet:
unknown
Number of open files:
70
Number of processes launched:
10
Processes remaning?
true
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/626ae1e3432bf24202a6a32f0971b3ceaefd75dee344d772762c52804c2f8016
Behaviour
Anti-VM
Process Renaming
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 109.126.195.104:6881
type: 178.69.209.93:6881
type: 87.253.97.232:6881
type: 37.133.21.45:6881
type: 176.195.191.18:6881
type: 121.92.217.49:6881
type: 37.195.138.12:6881
type: 91.65.47.5:6881
type: 5.3.173.105:6881
type: 82.64.227.52:6881
type: 5.167.174.24:6881
type: 94.198.237.87:6881
type: 176.213.155.23:6881
type: 79.152.143.205:6881
type: 84.106.252.254:6881
type: 66.252.114.122:6881
type: 46.72.126.4:6881
type: 188.42.55.92:6881
type: 45.154.86.83:6881
type: 2.134.120.36:6881
type: 185.133.105.39:6881
type: 186.108.206.210:6881
type: 109.94.11.111:6881
type: 176.196.233.159:6881
type: 95.66.153.96:6881
type: 97.177.36.174:6881
type: 31.205.93.79:6881
type: 128.1.86.214:6881
type: 18.223.137.220:6881
type: 116.86.96.10:6881
type: 18.188.31.0:6881
type: 18.190.61.127:6881
type: 179.233.21.133:6881
type: 54.214.62.55:6881
type: 176.28.66.85:6881
type: 45.12.26.157:6881
type: 54.194.124.68:6881
type: 195.35.14.152:6881
type: 18.221.7.72:6881
type: 35.155.156.153:6881
type: 188.68.169.159:6881
type: 77.25.220.8:6881
type: 91.233.88.227:6881
type: 61.79.218.176:6881
type: 115.66.60.223:6881
type: 109.248.217.19:6881
type: 174.105.181.109:6881
type: 78.157.120.5:6881
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 137.74.95.13:49999
type: 104.195.12.40:25829
type: 93.55.253.88:6889
type: 36.151.181.181:6889
type: 109.236.91.11:6889
type: 153.231.159.207:6889
type: 81.193.35.87:6889
type: 185.183.34.95:6889
type: 83.209.30.61:6889
type: 178.162.173.231:28001
type: 172.111.38.128:10066
type: 125.204.176.67:14739
type: 130.239.18.158:8539
type: 23.158.56.120:14097
type: 162.251.63.78:10086
type: 92.52.26.83:51413
type: 188.40.22.50:51413
type: 126.203.229.153:51413
type: 77.68.127.233:51413
type: 95.31.43.219:51413
type: 198.27.67.208:51413
type: 202.220.234.132:51413
type: 112.118.116.11:51413
type: 123.113.9.53:51413
type: 216.131.111.204:51413
type: 64.147.87.143:51413
type: 84.126.241.169:51413
type: 46.36.220.10:51413
type: 79.111.34.55:43226
type: 202.171.166.197:55872
type: 78.40.119.40:1159
type: 95.105.64.71:28796
type: 176.116.138.238:47310
type: 190.141.120.179:13984
type: 219.85.87.110:20749
type: 59.92.177.253:38318
type: 45.56.122.13:6880
type: 45.203.212.25:6880
type: 45.203.212.13:6880
type: 173.230.130.111:6880
type: 23.23.69.85:6880
type: 45.203.206.46:6880
type: 45.203.212.18:6880
type: 45.203.155.73:6880
type: 45.203.154.94:6880
type: 13.59.85.14:6880
type: 185.21.216.137:65379
type: 162.251.63.78:14089
type: 162.251.63.78:10015
type: 78.83.64.26:7319
type: 188.165.253.193:5060
type: 109.63.143.115:49413
type: 51.38.187.26:8687
type: 80.193.158.224:57408
type: 60.52.44.232:63219
type: 182.122.223.14:63219
type: 176.191.253.44:63842
type: 89.111.118.57:19895
type: 198.100.144.227:56733
type: 95.165.226.22:28889
type: 62.212.81.227:28013
type: 178.162.174.186:28013
type: 178.162.173.38:28007
type: 142.132.202.190:50000
type: 142.132.193.163:50000
type: 37.27.119.177:50000
type: 37.27.117.115:50000
type: 175.167.109.107:50000
type: 37.27.120.51:50000
type: 162.55.86.190:50000
type: 185.203.56.7:63571
type: 115.38.46.72:21893
type: 153.177.21.22:21042
type: 178.162.173.105:28004
type: 178.162.174.43:28004
type: 178.162.173.88:28004
type: 188.167.251.134:45005
type: 116.202.174.141:10048
type: 178.162.174.227:28003
type: 178.162.174.178:28003
type: 178.162.174.236:28003
type: 178.162.173.48:28003
type: 31.39.153.161:20146
type: 69.50.95.40:12013
type: 59.126.31.90:22666
type: 23.162.56.55:10032
type: 116.48.103.204:18222
type: 188.244.47.44:57851
type: 51.15.182.16:46871
type: 89.250.166.142:7193
type: 89.23.151.120:11349
type: 173.234.29.71:65008
type: 23.158.56.120:18071
type: 45.130.20.143:4176
type: 162.251.63.78:10031
type: 188.244.47.44:57858
type: 69.50.95.40:10025
type: 5.196.75.174:10005
type: 162.251.63.78:10010
type: 5.79.102.10:28009
type: 23.162.56.55:10079
type: 51.15.177.144:9527
type: 188.168.136.231:63447
type: 185.149.91.185:51059
type: 5.182.17.111:5091
type: 178.162.174.221:28000
type: 92.118.75.161:49001
type: 78.36.79.128:49001
type: 95.104.196.60:49001
type: 109.184.157.119:49001
type: 37.48.64.29:28002
type: 185.203.56.2:61731
type: 178.162.173.19:28011
type: 95.211.209.139:28011
type: 178.162.173.97:28011
type: 62.73.120.174:35885
type: 89.10.239.29:56176
type: 89.160.34.143:2145
type: 50.68.102.111:12117
type: 114.34.138.206:51417
type: 185.19.232.106:53620
type: 45.87.251.6:28045
type: 188.165.238.27:55932
type: 24.50.92.87:6882
type: 198.13.63.132:6882
type: 188.165.201.120:6882
type: 195.225.229.2:6882
type: 173.170.88.32:6882
type: 195.154.172.179:26076
type: 81.171.17.66:65268
type: 92.32.238.81:39825
type: 195.154.166.117:57731
type: 98.32.70.252:62067
type: 50.104.29.15:5991
type: 45.154.87.83:65273
type: 110.174.91.56:41322
type: 188.232.132.27:42051
type: 195.154.185.217:26101
type: 66.81.174.124:36105
type: 24.186.64.254:48281
type: 200.106.192.254:11116
type: 178.208.239.28:4379
type: 2.63.201.195:18951
type: 186.189.71.73:47527
type: 174.91.18.229:45229
type: 46.6.56.83:13674
type: 190.100.252.182:11010
type: 88.135.207.0:20608
type: 92.255.237.55:8999
type: 180.177.32.48:5036
type: 90.157.164.23:24376
type: 183.178.193.116:23962
type: 178.17.168.122:29090
type: 184.22.235.40:64369
type: 92.127.216.44:20570
type: 102.64.161.194:51545
type: 5.180.242.213:44880
type: 109.252.100.243:2016
type: 95.82.196.134:26135
type: 71.202.96.230:35088
type: 176.228.8.26:56566
type: 95.32.86.31:2407
type: 89.134.27.82:6811
type: 195.191.244.26:1098
type: 69.204.198.148:22920
type: 85.244.118.19:33333
type: 89.139.80.204:50951
type: 54.211.14.111:20872
type: 73.185.158.70:44923
type: 83.86.192.210:19388
type: 83.221.20.248:53230
type: 5.107.63.26:16195
type: 89.151.189.63:3341
type: 143.137.79.169:11260
type: 146.59.3.81:10240
type: 223.109.206.212:6892
type: 54.209.131.199:6892
type: 151.33.231.225:6895
type: 37.203.8.3:50850
type: 98.255.140.228:9010
type: 37.10.77.165:59475
type: 5.140.162.245:34489
type: 176.214.122.72:37110
type: 185.33.161.174:50923
type: 176.213.247.165:42460
type: 152.53.45.107:7339
type: 54.39.52.183:36035
type: 54.194.135.233:6992
type: 189.105.154.138:41535
type: 61.80.110.108:2660
type: 195.154.87.171:50673
type: 212.7.202.40:28030
type: 69.50.95.40:10050
type: 31.58.51.146:6985
type: 45.87.251.132:28215
type: 95.214.53.172:1688
type: 190.3.40.13:34303
type: 94.233.146.198:5167
type: 31.58.51.146:6937
type: 89.22.226.106:6932
type: 152.53.45.107:7135
type: 37.99.69.165:32874
type: 201.233.191.110:52655
type: 213.59.162.38:21543
type: 72.21.17.24:64296
type: 95.24.206.165:23299
type: 213.230.93.112:49333
type: 202.61.194.107:32681
type: 73.68.123.98:24535
type: 49.12.86.202:6883
type: 114.80.9.156:6883
type: 77.240.33.133:24891
type: 83.139.129.38:1319
type: 46.173.52.193:63312
type: 46.232.211.209:64125
type: 76.24.8.81:50460
type: 138.255.137.195:44411
type: 190.240.39.119:40668
type: 178.65.125.157:27608
type: 46.148.132.32:2317
type: 95.18.106.232:44819
type: 178.162.174.117:28012
type: 83.142.5.248:45728
type: 185.21.217.19:60693
type: 140.233.190.127:28330
type: 104.152.209.165:64731
type: 114.142.76.101:15134
type: 46.232.211.79:13359
type: 46.242.15.32:27776
type: 45.11.112.126:32000
type: 78.73.26.246:1503
type: 85.95.215.175:27564
type: 138.64.87.33:44833
type: 69.254.13.216:59716
type: 220.246.179.198:19223
type: 46.150.69.124:54874
type: 61.1.132.48:60070
type: 89.134.9.2:6905
type: 188.113.150.81:5774
type: 46.208.112.254:56952
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/186fa489-a9f6-4f7c-9767-c005889fcb79
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1699694
Signature
Executes the "crontab" command typically for achieving persistence
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1699694 Sample: amd64.elf Startdate: 27/05/2025 Architecture: LINUX Score: 68 44 179.106.156.74, 49301 microplaninformaticaltdaBR Brazil 2->44 46 118.93.7.73, 25854, 6881 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ New Zealand 2->46 48 101 other IPs or domains 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Uses known network protocols on non-standard ports 2->52 10 amd64.elf 2->10         started        12 dash rm 2->12         started        14 dash head 2->14         started        16 8 other processes 2->16 signatures3 process4 process5 18 amd64.elf sh 10->18         started        20 amd64.elf 10->20         started        23 amd64.elf sh 10->23         started        signatures6 25 sh crontab 18->25         started        29 sh 18->29         started        56 Opens /sys/class/net/* files useful for querying network interface information 20->56 58 Sample reads /proc/mounts (often used for finding a writable filesystem) 20->58 31 amd64.elf 20->31         started        33 sh crontab 23->33         started        process7 file8 42 /var/spool/cron/crontabs/tmp.t3Mi1n, ASCII 25->42 dropped 60 Sample tries to persist itself using cron 25->60 62 Executes the "crontab" command typically for achieving persistence 25->62 35 sh crontab 29->35         started        38 amd64.elf 31->38         started        signatures9 process10 signatures11 54 Executes the "crontab" command typically for achieving persistence 35->54 40 amd64.elf 38->40         started        process12
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/626ae1e3432bf24202a6a32f0971b3ceaefd75dee344d772762c52804c2f8016
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/626ae1e3432bf24202a6a32f0971b3ceaefd75dee344d772762c52804c2f8016/
Threat name:
Linux.Trojan.SAgnt
Create hunting rule
Status:
Malicious
First seen:
2025-05-27 09:46:13 UTC
File Type:
ELF64 Little (Exe)
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mjvody2dfpzeeavgumxqs4ntz2xp25o64ncno4twfrjiatbpqala._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/250527-lrpxvaeq5z/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Checks hardware identifiers (DMI)
Creates/modifies Cron job
Enumerates running processes
Reads MAC address of network interface
Reads hardware information
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1cf020af-b585-482a-80f1-1735557901df
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/626ae1e3432bf24202a6a32f0971b3ceaefd75dee344d772762c52804c2f8016

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:enterpriseunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise UNIX
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 626ae1e3432bf24202a6a32f0971b3ceaefd75dee344d772762c52804c2f8016

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3550042/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments