MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e202c780acb87a7d4e8c30365b365b687c79dd7896ec1aff0ccb3f7eeb9bb00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e202c780acb87a7d4e8c30365b365b687c79dd7896ec1aff0ccb3f7eeb9bb00
SHA3-384 hash: 524790ca583c4ea325a8947ac39281fe4c735dda39b2e2af9c90a63a02aae4bc1e4ea16215b62c55646b97d86ee7d160
SHA1 hash: aa19fe85a79c2173abc82c119ad914fb85aad421
MD5 hash: 2f5c5dc4e10a713632535b55f53bd97d
humanhash: xray-wolfram-march-mountain
File name:i686
Download: download sample
File size:587'764 bytes
First seen:2025-06-21 04:45:34 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V
TLSH T1C2C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B42869E66C
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.31951.LX.BOT.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68563900affecf6a2c0565fdlinux22vpnfull_triage
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Sends data to a server
Creating a file in the %temp% directory
Opens a port
DNS request
Creates directories
Connection attempt
Locks files
Changes access rights for a written file
Creating a process from a recently created file
Launching a process
Collects information on the CPU
Receives data from a server
Changes the time when the file was created, accessed, or modified
Runs as daemon
Creates or modifies files in /cron to set up autorun
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
exploit gcc lolbin remote
Link:
https://www.filescan.io/uploads/685638f88e19e7aebeef7a31/reports/448961b2-a865-4c2b-aece-b6c2d5b2e7a0/overview
Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
true
Architecture:
x86
Packer:
custom
Botnet:
unknown
Number of open files:
72
Number of processes launched:
10
Processes remaning?
false
Remote TCP ports scanned:
48685
Full report:
https://elfdigest.com/brief/6e202c780acb87a7d4e8c30365b365b687c79dd7896ec1aff0ccb3f7eeb9bb00
Behaviour
Anti-VM
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 178.69.209.93:6881
type: 63.247.211.162:6881
type: 93.114.235.14:6881
type: 176.72.161.201:6881
type: 176.125.139.123:6881
type: 89.207.71.47:6881
type: 188.42.55.92:6881
type: 85.15.107.13:6881
type: 91.203.188.18:6881
type: 50.70.156.72:6881
type: 93.41.157.27:6881
type: 207.188.149.70:6881
type: 87.249.134.3:6881
type: 24.130.37.231:6881
type: 5.39.91.215:6881
type: 176.221.2.205:6881
type: 220.82.100.81:6881
type: 46.174.227.227:6881
type: 89.135.206.214:6881
type: 80.220.218.186:6881
type: 75.119.138.164:6881
type: 141.98.154.145:6881
type: 112.104.91.221:6881
type: 54.70.28.180:6881
type: 54.214.62.55:6881
type: 167.99.72.189:6881
type: 72.14.148.48:6881
type: 18.223.137.220:6881
type: 69.180.6.249:6881
type: 54.214.105.212:6881
type: 144.217.72.98:6881
type: 51.83.33.163:6881
type: 85.234.39.28:6881
type: 158.220.106.222:6881
type: 188.113.188.71:6881
type: 185.209.30.126:6881
type: 121.122.122.4:6881
type: 95.66.217.20:6881
type: 122.193.195.177:6881
type: 124.169.119.253:6881
type: 107.181.234.235:6881
type: 89.168.99.211:6881
type: 31.208.53.189:6881
type: 112.84.236.24:6881
type: 178.162.174.222:28014
type: 83.149.98.184:28014
type: 178.162.174.77:28014
type: 82.172.167.161:6889
type: 168.226.64.36:6889
type: 78.58.203.10:6889
type: 114.230.238.79:6889
type: 213.96.29.168:6889
type: 99.151.15.244:6889
type: 188.153.64.139:6889
type: 178.162.174.43:28004
type: 178.162.174.228:28004
type: 178.162.174.81:28004
type: 178.162.173.160:28004
type: 94.75.234.248:28004
type: 130.239.18.158:8524
type: 135.181.238.57:50000
type: 135.181.227.244:50000
type: 135.181.238.122:50000
type: 37.27.120.55:50000
type: 37.27.103.253:50000
type: 65.21.125.185:50000
type: 65.21.129.47:50000
type: 37.27.117.249:50000
type: 37.27.117.190:50000
type: 37.27.119.180:50000
type: 65.21.128.225:50000
type: 37.27.107.118:50000
type: 37.27.119.179:50000
type: 65.21.129.52:50000
type: 37.27.107.114:50000
type: 37.27.117.117:50000
type: 37.27.107.119:50000
type: 37.27.119.182:50000
type: 37.27.117.113:50000
type: 37.27.107.123:50000
type: 65.21.128.247:50000
type: 135.181.134.224:50000
type: 130.239.18.158:8515
type: 31.210.173.50:27520
type: 178.162.173.91:28003
type: 178.162.174.178:28003
type: 178.162.174.169:28003
type: 178.162.174.233:28003
type: 130.239.18.158:8513
type: 178.162.174.226:28005
type: 178.162.174.238:28005
type: 178.162.173.102:28005
type: 130.239.18.158:8500
type: 104.195.12.40:25829
type: 93.51.18.111:51413
type: 212.251.201.227:51413
type: 193.19.220.180:51413
type: 198.100.145.51:51413
type: 84.217.73.58:51413
type: 95.31.43.219:51413
type: 198.27.67.208:51413
type: 77.174.206.68:51413
type: 45.154.86.160:51413
type: 5.135.163.217:51413
type: 5.135.155.133:51413
type: 139.162.171.161:51413
type: 188.40.253.246:51413
type: 149.75.40.82:51413
type: 172.13.109.108:51413
type: 37.187.122.6:51413
type: 77.37.196.197:51413
type: 221.145.24.22:51413
type: 123.118.107.248:51413
type: 62.210.206.120:51413
type: 5.79.74.166:51413
type: 103.174.51.52:51413
type: 62.210.71.78:51413
type: 95.211.194.52:51413
type: 106.70.111.242:51413
type: 193.32.23.169:51413
type: 124.188.233.175:51413
type: 178.33.233.79:8999
type: 213.232.235.11:8999
type: 212.47.228.59:8999
type: 5.39.85.82:55428
type: 5.79.66.11:54337
type: 185.203.56.50:61573
type: 185.132.179.61:6892
type: 52.70.34.253:6880
type: 195.154.233.74:6880
type: 173.230.130.111:6880
type: 45.203.208.35:6880
type: 131.147.243.110:6880
type: 52.21.231.83:6880
type: 3.130.60.88:6880
type: 45.203.151.81:6880
type: 18.189.222.30:6880
type: 44.193.139.87:6880
type: 94.26.79.221:16677
type: 5.182.17.111:5091
type: 178.162.174.221:28000
type: 178.162.174.56:28000
type: 178.162.173.141:28000
type: 178.162.173.193:28000
type: 178.162.174.234:28000
type: 95.168.162.161:42670
type: 178.162.173.231:28001
type: 130.239.18.158:8539
type: 213.227.152.73:28002
type: 5.79.93.242:61920
type: 178.162.174.53:28008
type: 91.134.50.247:36909
type: 45.87.251.6:28049
type: 186.216.58.25:16067
type: 195.201.179.130:16309
type: 185.149.91.21:51118
type: 95.211.247.101:28009
type: 141.95.53.34:8648
type: 5.135.156.163:56843
type: 130.239.18.158:8580
type: 130.239.18.158:8516
type: 95.211.110.228:28012
type: 178.162.174.119:28012
type: 178.162.173.218:28012
type: 178.162.173.9:28012
type: 5.39.94.219:45467
type: 89.149.202.13:28035
type: 45.152.210.34:50171
type: 193.23.250.86:50171
type: 45.91.209.42:50171
type: 178.162.174.102:28007
type: 178.162.174.228:28007
type: 178.162.173.163:28006
type: 51.159.104.76:7186
type: 178.162.174.222:28011
type: 45.91.208.243:51936
type: 37.48.89.181:48531
type: 185.107.71.103:44737
type: 176.63.18.48:13291
type: 94.23.1.211:49838
type: 195.154.172.179:23320
type: 169.150.223.219:64198
type: 5.9.41.13:53504
type: 46.232.210.157:64170
type: 84.247.173.42:8081
type: 60.129.102.105:23848
type: 193.30.123.75:18211
type: 109.236.91.11:6887
type: 46.232.210.29:22109
type: 51.112.110.177:20895
type: 70.29.166.47:49001
type: 94.190.76.48:49001
type: 219.77.37.219:24295
type: 38.49.85.98:55863
type: 111.168.184.234:12836
type: 84.15.182.143:2621
type: 220.87.199.26:41217
type: 161.230.249.34:50321
type: 179.98.26.233:50321
type: 106.163.235.101:58456
type: 72.21.17.2:12259
type: 185.203.56.39:23177
type: 102.141.168.197:18116
type: 77.251.98.144:11568
type: 93.125.121.226:25240
type: 103.140.3.7:19116
type: 213.130.78.69:59210
type: 51.174.240.186:24419
type: 37.34.207.173:21100
type: 86.127.126.157:57121
type: 93.44.207.91:39989
type: 95.91.213.18:44541
type: 188.230.255.160:60756
type: 185.21.217.56:54442
type: 1.157.96.67:51002
type: 185.200.116.219:14697
type: 210.178.179.58:41038
type: 210.121.206.180:33048
type: 164.132.162.3:54952
type: 188.165.231.168:57673
type: 116.251.192.15:6882
type: 158.51.125.251:6882
type: 186.96.213.46:6882
type: 94.23.215.83:6882
type: 115.124.178.122:42587
type: 157.48.159.75:46605
type: 121.134.138.144:40570
type: 185.107.71.98:20613
type: 46.232.210.231:64072
type: 46.232.210.231:64155
type: 178.162.174.155:28016
type: 162.55.243.114:2910
type: 152.53.104.128:10240
type: 195.170.172.38:10240
type: 194.29.101.83:10240
type: 94.248.146.231:5173
type: 46.232.210.231:64144
type: 43.240.149.123:32681
type: 210.99.33.142:49157
type: 37.187.105.200:62285
type: 114.108.88.207:40775
type: 24.160.32.21:48210
type: 98.41.192.29:10587
type: 89.117.1.188:54072
type: 162.55.243.114:1910
type: 176.38.55.45:36819
type: 89.134.27.189:44207
type: 173.176.239.251:59128
type: 176.31.183.98:46326
type: 106.205.155.76:56024
type: 54.39.52.64:39450
type: 223.184.233.43:30069
type: 185.132.134.245:6883
type: 5.79.85.89:64158
type: 178.132.4.27:6886
type: 185.70.17.8:32000
type: 218.102.130.50:13903
type: 46.232.211.91:15959
type: 5.79.67.12:43710
type: 86.17.197.55:20229
type: 118.34.123.182:32620
type: 183.83.195.173:59227
type: 75.181.20.63:45174
type: 220.88.62.35:40886
type: 124.63.113.143:51568
type: 222.101.28.142:43633
type: 116.46.125.132:40854
type: 94.23.21.8:62908
type: 46.232.211.100:16709
type: 45.154.86.101:56118
type: 176.63.15.170:11311
type: 115.3.83.186:50796
type: 46.235.121.63:25806
type: 93.40.240.72:14617
type: 105.209.230.188:7253
type: 23.95.11.50:65524
type: 87.126.208.61:4781
type: 173.206.124.50:60102
type: 185.255.237.4:57017
type: 15.235.82.46:47265
type: 178.43.203.221:37991
type: 41.107.224.38:44166
type: 94.31.70.95:5233
type: 90.243.45.138:40583
type: 185.21.216.155:41773
type: 144.126.147.92:6956
type: 162.81.201.68:19683
type: 27.93.18.132:26893
type: 89.149.197.229:55979
type: 84.40.75.188:36029
type: 149.22.89.94:57308
type: 91.181.195.157:27199
type: 210.183.60.98:22003
type: 186.122.212.225:6104
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3aacd0d8-25f3-44e2-a0ce-7abce8f91e69
Behavior Graph:
Download SVG
%3 guuid=a7692831-1a00-0000-9f57-bb43c30a0000 pid=2755 /usr/bin/sudo guuid=a63a9133-1a00-0000-9f57-bb43c80a0000 pid=2760 /root/.sys/configuration guuid=a7692831-1a00-0000-9f57-bb43c30a0000 pid=2755->guuid=a63a9133-1a00-0000-9f57-bb43c80a0000 pid=2760 execve guuid=5347b933-1a00-0000-9f57-bb43ca0a0000 pid=2762 /usr/bin/dash guuid=a63a9133-1a00-0000-9f57-bb43c80a0000 pid=2760->guuid=5347b933-1a00-0000-9f57-bb43ca0a0000 pid=2762 execve guuid=19df0834-1a00-0000-9f57-bb43cb0a0000 pid=2763 /usr/bin/dash guuid=a63a9133-1a00-0000-9f57-bb43c80a0000 pid=2760->guuid=19df0834-1a00-0000-9f57-bb43cb0a0000 pid=2763 execve guuid=9ee48734-1a00-0000-9f57-bb43cf0a0000 pid=2767 /root/.sys/configuration zombie guuid=a63a9133-1a00-0000-9f57-bb43c80a0000 pid=2760->guuid=9ee48734-1a00-0000-9f57-bb43cf0a0000 pid=2767 clone guuid=ec024c34-1a00-0000-9f57-bb43cd0a0000 pid=2765 /usr/bin/dash guuid=19df0834-1a00-0000-9f57-bb43cb0a0000 pid=2763->guuid=ec024c34-1a00-0000-9f57-bb43cd0a0000 pid=2765 clone guuid=ebaa5234-1a00-0000-9f57-bb43ce0a0000 pid=2766 /usr/bin/dash guuid=19df0834-1a00-0000-9f57-bb43cb0a0000 pid=2763->guuid=ebaa5234-1a00-0000-9f57-bb43ce0a0000 pid=2766 clone guuid=eb280b3b-1a00-0000-9f57-bb43dc0a0000 pid=2780 /root/.sys/configuration guuid=9ee48734-1a00-0000-9f57-bb43cf0a0000 pid=2767->guuid=eb280b3b-1a00-0000-9f57-bb43dc0a0000 pid=2780 clone guuid=679e1a3b-1a00-0000-9f57-bb43dd0a0000 pid=2781 /root/.sys/configuration guuid=eb280b3b-1a00-0000-9f57-bb43dc0a0000 pid=2780->guuid=679e1a3b-1a00-0000-9f57-bb43dd0a0000 pid=2781 clone guuid=8460283b-1a00-0000-9f57-bb43de0a0000 pid=2782 /root/.sys/configuration dns net net-scan send-data guuid=679e1a3b-1a00-0000-9f57-bb43dd0a0000 pid=2781->guuid=8460283b-1a00-0000-9f57-bb43de0a0000 pid=2782 clone d316b2ae-0a7e-5b43-8de6-745900c90c54 127.0.0.1:65535 guuid=8460283b-1a00-0000-9f57-bb43de0a0000 pid=2782->d316b2ae-0a7e-5b43-8de6-745900c90c54 con 38a4910e-6f05-5afe-a8e3-398c2eb18329 time.cloudflare.com:123 guuid=8460283b-1a00-0000-9f57-bb43de0a0000 pid=2782->38a4910e-6f05-5afe-a8e3-398c2eb18329 send: 48B 832fc9f7-b8d0-5460-beb6-e00a786a2ae2 31.200.249.162:31970 guuid=8460283b-1a00-0000-9f57-bb43de0a0000 pid=2782->832fc9f7-b8d0-5460-beb6-e00a786a2ae2 send: 68B guuid=8460283b-1a00-0000-9f57-bb43de0a0000 pid=2782|send-data send-data to 284 IP addresses review logs to see them all guuid=8460283b-1a00-0000-9f57-bb43de0a0000 pid=2782->guuid=8460283b-1a00-0000-9f57-bb43de0a0000 pid=2782|send-data send
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d7f8a0bd-38f5-4ec7-961c-7d0e50b82237
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1719772
Signature
Connects to many ports of the same IP (likely port scanning)
Executes the "crontab" command typically for achieving persistence
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1719772 Sample: i686.elf Startdate: 21/06/2025 Architecture: LINUX Score: 68 38 31.200.249.162, 31790, 41654 NETRACK-ASRU Russian Federation 2->38 40 62.182.86.86, 40758, 6881 YANINA-ASUA Ukraine 2->40 42 102 other IPs or domains 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Connects to many ports of the same IP (likely port scanning) 2->46 10 i686.elf configuration 2->10         started        signatures3 process4 process5 12 i686.elf sh 10->12         started        14 configuration 10->14         started        17 i686.elf sh 10->17         started        signatures6 19 sh crontab 12->19         started        23 sh 12->23         started        54 Opens /sys/class/net/* files useful for querying network interface information 14->54 56 Sample reads /proc/mounts (often used for finding a writable filesystem) 14->56 25 configuration 14->25         started        27 sh crontab 17->27         started        process7 file8 36 /var/spool/cron/crontabs/tmp.aBGwTA, ASCII 19->36 dropped 48 Sample tries to persist itself using cron 19->48 50 Executes the "crontab" command typically for achieving persistence 19->50 29 sh crontab 23->29         started        32 configuration 25->32         started        signatures9 process10 signatures11 52 Executes the "crontab" command typically for achieving persistence 29->52 34 configuration 32->34         started        process12
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/6e202c780acb87a7d4e8c30365b365b687c79dd7896ec1aff0ccb3f7eeb9bb00
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e202c780acb87a7d4e8c30365b365b687c79dd7896ec1aff0ccb3f7eeb9bb00/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2025-06-21 04:47:19 UTC
File Type:
ELF32 Little (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nyqcy6akzod2pvhiymbwlm3fw2d4phoxrfxmdl7qzsz7p3vzxmaa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution linux persistence privilege_escalation rootkit
Link:
https://tria.ge/reports/250621-fdstpayscv/
Behaviour
Creates/modifies Cron job
Loads a kernel module
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/985aca3c-d50d-4169-a357-f252974c06f4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e202c780acb87a7d4e8c30365b365b687c79dd7896ec1aff0ccb3f7eeb9bb00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 6e202c780acb87a7d4e8c30365b365b687c79dd7896ec1aff0ccb3f7eeb9bb00

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3558166/
  
Delivery method
Distributed via web download

Comments