MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d95f15e7200e8985f01e19f9fca49e87c2bab198eb533473b4b0e4b6e199b0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	6d95f15e7200e8985f01e19f9fca49e87c2bab198eb533473b4b0e4b6e199b0b
SHA3-384 hash:	b8df557465f644713cca5716e720d5494ef9cd47bf2ce4cf30e22c718fb87a330e0b2788a0737560d693842379e5d6fb
SHA1 hash:	95ae106da0ce1cc0a74fe777d0a9776c428179d0
MD5 hash:	fe60be233e7c46c4791d635a01c07a77
humanhash:	golf-steak-oxygen-spring
File name:	arm926t
Download:	download sample
File size:	480'792 bytes
First seen:	2025-07-11 11:19:05 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
TLSH	T16CA40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB2662D745A4F7E400
telfhash	t186c08c8c0fd401beba7d72a203bef2bf61a072f0be0224920404eb6f074c584028144c
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Siggen.9148.UNOFFICIAL

Sanesecurity.Malware.32055.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6870f342900df8e7f869d440linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Receives data from a server

Locks files

Creates directories

Changes the time when the file was created, accessed, or modified

Opens a port

Creating a file in the %temp% directory

Collects information on the CPU

DNS request

Runs as daemon

Creating a file

Changes access rights for a written file

Sends data to a server

Creating a process from a recently created file

Connection attempt

Launching a process

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

exploit gcc lolbin packed remote

Link:

https://www.filescan.io/uploads/6870f34480b46be06e9fc8a0/reports/9e971bb5-fde7-4bc3-9288-dbd72b5717c1/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

103

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/6d95f15e7200e8985f01e19f9fca49e87c2bab198eb533473b4b0e4b6e199b0b

Behaviour

Anti-VM

Persistence

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 89.179.246.14:6881
type: 89.207.71.47:6881
type: 188.42.55.92:6881
type: 45.80.169.122:6881
type: 119.105.108.214:6881
type: 188.134.79.161:6881
type: 81.109.45.198:6881
type: 159.196.128.103:6881
type: 46.150.56.115:6881
type: 95.37.26.86:6881
type: 89.77.92.187:6881
type: 172.100.250.213:6881
type: 148.163.166.3:6881
type: 123.243.35.246:6881
type: 178.224.69.254:6881
type: 45.142.90.76:6881
type: 46.39.224.216:6881
type: 92.148.40.51:6881
type: 86.246.192.183:6881
type: 92.148.220.97:6881
type: 99.184.51.81:6881
type: 176.74.11.74:6881
type: 178.206.176.150:6881
type: 74.139.238.214:6881
type: 87.10.165.159:6881
type: 148.135.106.206:6881
type: 188.129.136.182:6881
type: 73.64.206.123:6881
type: 192.227.221.84:6881
type: 35.163.251.58:6881
type: 18.191.2.28:6881
type: 69.242.42.210:6881
type: 54.214.62.55:6881
type: 13.58.27.33:6881
type: 107.171.217.218:6881
type: 142.171.125.191:6881
type: 186.87.86.44:6881
type: 54.70.28.180:6881
type: 54.194.124.68:6881
type: 176.221.2.100:6881
type: 216.232.203.250:6881
type: 31.104.73.37:6881
type: 135.181.238.57:50000
type: 65.21.129.56:50000
type: 135.181.227.244:50000
type: 37.27.119.190:50000
type: 65.21.125.166:50000
type: 37.27.119.253:50000
type: 138.201.61.180:50000
type: 65.21.128.209:50000
type: 65.108.194.186:50000
type: 195.201.153.69:50000
type: 37.27.103.179:50000
type: 65.21.125.179:50000
type: 65.109.48.159:50000
type: 37.27.119.189:50000
type: 37.27.117.60:50000
type: 37.27.117.61:50000
type: 37.27.117.47:50000
type: 65.21.129.53:50000
type: 135.181.227.248:50000
type: 135.181.227.240:50000
type: 37.27.117.177:50000
type: 95.216.14.165:50000
type: 135.181.115.53:50000
type: 37.27.119.251:50000
type: 37.27.117.59:50000
type: 135.181.238.121:50000
type: 65.21.125.172:50000
type: 65.21.125.161:50000
type: 37.27.104.57:50000
type: 37.27.117.182:50000
type: 65.21.125.160:50000
type: 65.21.128.230:50000
type: 65.108.102.46:50000
type: 135.181.238.113:50000
type: 37.27.120.58:50000
type: 65.21.129.41:50000
type: 37.27.117.56:50000
type: 65.21.128.242:50000
type: 65.109.35.105:50000
type: 37.27.117.180:50000
type: 167.235.10.94:50000
type: 65.21.128.245:50000
type: 37.27.117.187:50000
type: 176.9.25.249:50000
type: 37.27.119.183:50000
type: 37.27.120.55:50000
type: 65.21.128.246:50000
type: 37.27.119.180:50000
type: 65.108.10.56:50000
type: 65.21.128.223:50000
type: 178.162.174.222:28014
type: 178.162.174.82:28014
type: 178.162.174.106:28014
type: 178.162.173.15:28014
type: 130.239.18.158:8515
type: 178.162.173.153:28012
type: 178.162.174.185:28012
type: 83.149.98.181:28012
type: 178.162.174.149:28001
type: 178.162.173.231:28001
type: 178.162.174.224:28001
type: 23.158.56.120:14017
type: 5.79.73.211:6918
type: 46.232.211.200:25759
type: 173.230.130.111:6880
type: 195.154.233.74:6880
type: 18.213.98.90:6880
type: 52.21.231.83:6880
type: 195.137.220.143:6880
type: 178.162.174.178:28003
type: 178.162.173.91:28003
type: 178.162.174.227:28003
type: 178.162.174.169:28003
type: 130.239.18.158:8539
type: 144.76.175.153:55363
type: 185.153.178.99:49001
type: 68.41.93.116:49001
type: 5.166.86.236:49001
type: 82.165.50.12:51413
type: 95.211.81.107:51413
type: 145.223.18.11:51413
type: 45.83.232.30:51413
type: 188.166.98.93:51413
type: 85.166.175.80:51413
type: 93.89.141.246:51413
type: 150.230.113.50:51413
type: 153.232.69.130:51413
type: 51.15.187.217:51413
type: 37.187.115.183:51413
type: 140.238.65.211:51413
type: 182.169.106.48:51413
type: 5.137.195.208:51413
type: 87.71.163.216:51413
type: 141.148.226.61:51413
type: 185.209.30.177:51413
type: 80.209.237.15:51413
type: 80.39.159.142:51413
type: 95.211.162.241:51413
type: 130.239.18.158:8580
type: 130.239.18.158:8516
type: 83.149.84.32:28008
type: 37.48.118.19:28008
type: 130.239.18.158:8597
type: 130.239.18.158:8513
type: 64.23.210.4:34287
type: 45.87.251.149:28063
type: 185.203.56.49:25627
type: 95.168.168.200:40477
type: 69.50.95.40:10085
type: 79.11.107.190:6889
type: 31.179.165.38:6889
type: 83.139.224.249:6889
type: 212.158.136.87:6889
type: 185.149.91.185:51059
type: 178.162.174.46:28013
type: 95.211.247.101:28013
type: 213.227.151.25:28013
type: 178.162.174.31:28013
type: 178.168.49.40:33282
type: 185.203.56.68:62927
type: 172.96.121.2:6884
type: 178.162.174.45:28015
type: 178.162.174.239:28015
type: 45.91.208.34:53733
type: 195.154.171.138:30519
type: 212.7.200.93:23999
type: 185.203.56.65:61326
type: 178.162.173.89:28007
type: 81.171.6.44:28007
type: 5.135.165.33:6331
type: 88.198.230.221:49668
type: 185.21.216.185:60731
type: 46.232.210.157:64170
type: 146.70.137.18:50974
type: 95.211.175.145:8151
type: 89.149.200.92:28037
type: 144.76.175.153:33986
type: 212.32.255.118:28010
type: 37.48.86.173:28002
type: 185.149.91.147:51005
type: 222.166.83.32:16672
type: 54.39.50.190:29939
type: 178.162.174.43:28004
type: 130.239.18.158:8524
type: 95.168.162.161:42670
type: 87.66.235.228:56171
type: 37.48.111.174:40220
type: 178.162.174.17:28006
type: 195.154.185.217:26017
type: 195.154.185.217:23047
type: 144.76.175.153:35393
type: 37.27.113.233:35393
type: 46.232.211.230:12209
type: 65.108.143.34:51777
type: 181.135.93.111:50476
type: 144.76.175.153:51778
type: 37.27.113.233:51778
type: 144.76.175.153:35394
type: 97.103.36.212:58974
type: 37.48.89.196:25031
type: 58.152.74.170:51414
type: 195.154.172.179:24918
type: 72.21.17.60:28666
type: 81.240.178.125:45810
type: 54.188.100.48:8850
type: 45.87.251.183:57479
type: 222.105.171.61:7667
type: 46.150.69.110:47235
type: 162.250.188.146:57581
type: 104.152.208.27:50970
type: 149.40.59.135:64164
type: 185.203.56.56:20360
type: 148.71.171.147:25300
type: 76.100.80.30:19036
type: 72.21.17.92:13382
type: 5.196.73.184:55714
type: 62.212.84.114:6920
type: 151.95.105.68:59835
type: 93.34.89.5:8192
type: 73.19.77.219:28463
type: 188.163.64.25:49441
type: 98.45.178.143:27722
type: 93.39.144.175:7869
type: 190.106.222.99:34860
type: 105.75.35.46:54293
type: 149.34.150.192:61413
type: 82.61.180.170:17679
type: 87.70.8.172:57075
type: 211.193.88.209:40233
type: 95.7.13.10:37494
type: 171.97.218.50:3234
type: 86.126.7.209:62314
type: 49.207.232.164:31806
type: 195.154.185.217:28215
type: 92.253.1.152:14797
type: 18.196.86.103:6992
type: 194.29.101.83:10240
type: 64.33.110.136:11374
type: 188.190.72.87:59853
type: 188.165.231.168:56571
type: 86.100.7.174:36280
type: 54.194.137.170:6882
type: 24.57.60.247:6882
type: 191.126.60.237:62529
type: 217.208.78.123:17329
type: 54.39.52.64:64804
type: 176.31.183.98:33764
type: 186.122.0.10:42207
type: 23.95.32.170:6969
type: 72.21.17.26:25662
type: 176.25.4.160:19849
type: 37.27.113.233:49030
type: 200.109.193.152:17587
type: 54.77.218.23:6892
type: 185.183.32.101:6892
type: 31.134.179.10:60588
type: 84.115.224.10:7029
type: 216.144.112.49:6887
type: 83.149.106.18:46276
type: 49.246.7.150:7663
type: 89.64.29.152:5842
type: 185.21.216.142:53064
type: 79.116.190.214:8993
type: 176.113.74.85:55302
type: 218.255.65.181:9004
type: 186.235.99.146:38227
type: 5.39.91.138:18881
type: 84.254.90.19:64098
type: 60.140.81.150:49500
type: 1.21.119.117:22487
type: 95.168.168.220:57444
type: 139.47.125.141:34473
type: 180.198.26.40:18946
type: 45.173.86.53:34717
type: 130.239.18.158:8512
type: 46.232.211.178:64253
type: 154.126.213.242:64345
type: 151.192.151.121:51583

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/5bf5aafd-181a-48e8-9c3e-f30a6b95a91d

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/29f13322-0c75-4bb9-853a-84bd09b0ea23

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/6d95f15e7200e8985f01e19f9fca49e87c2bab198eb533473b4b0e4b6e199b0b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6d95f15e7200e8985f01e19f9fca49e87c2bab198eb533473b4b0e4b6e199b0b/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-07-11 11:19:28 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nwk7cxtsadujqxyb4gpz7ssj5b6cxkyzr22tgrz3jmhew3qztmfq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250711-ne1vpawjt9/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1f5864d0-97a7-40d1-aff5-3d742667999c

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6d95f15e7200e8985f01e19f9fca49e87c2bab198eb533473b4b0e4b6e199b0b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 6d95f15e7200e8985f01e19f9fca49e87c2bab198eb533473b4b0e4b6e199b0b

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558169/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample