MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77b8934d3f2b8afe9d349d912f2e10d9d1fbbb2c4a963c82916895c93cb29875. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	77b8934d3f2b8afe9d349d912f2e10d9d1fbbb2c4a963c82916895c93cb29875
SHA3-384 hash:	9f3ff0faf36c151ce5cc5aef54e723f1cbccfb1fbb2d3fa45823db7b9d032f2349d55b3ce8b9a5217873a3cfa13f0b40
SHA1 hash:	1ae1f13b4b447425dd91268b65c36747d9f2a794
MD5 hash:	389c516f140984f6eef4e1afa6f5e731
humanhash:	kilo-july-three-single
File name:	amd64
Download:	download sample
File size:	482'032 bytes
First seen:	2025-05-30 00:27:06 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR
TLSH	T184A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F6322B3AE601B16A55
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.31951.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6838fc65acf88f5815e8b780linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates directories

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

exploit gcc lolbin remote

Link:

https://www.filescan.io/uploads/6838fb76fd02ed5e058f7017/reports/d829b8b9-8185-4ea1-b755-8f8c014f41de/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

x86

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/77b8934d3f2b8afe9d349d912f2e10d9d1fbbb2c4a963c82916895c93cb29875

Behaviour

Anti-VM

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 45.154.86.83:6881
type: 87.253.97.232:6881
type: 176.221.6.220:6881
type: 176.193.231.215:6881
type: 86.97.68.69:6881
type: 46.138.248.66:6881
type: 63.247.211.162:6881
type: 77.51.55.26:6881
type: 178.183.166.202:6881
type: 5.101.194.86:6881
type: 83.164.117.236:6881
type: 85.215.59.222:6881
type: 188.42.55.92:6881
type: 85.130.146.252:6881
type: 195.198.145.208:6881
type: 109.226.214.101:6881
type: 73.164.146.248:6881
type: 66.252.114.122:6881
type: 84.106.252.254:6881
type: 94.198.237.87:6881
type: 94.233.57.77:6881
type: 37.133.21.45:6881
type: 178.69.209.93:6881
type: 37.97.44.196:6881
type: 67.170.101.18:6881
type: 211.105.193.230:6881
type: 58.177.9.86:6881
type: 91.119.100.186:6881
type: 88.9.145.44:6881
type: 92.207.68.45:6881
type: 59.28.84.147:6881
type: 91.46.108.234:6881
type: 81.163.110.4:6881
type: 99.199.7.29:6881
type: 213.91.135.218:6881
type: 179.248.188.161:6881
type: 109.184.111.173:6881
type: 27.60.167.240:6881
type: 5.142.23.254:6881
type: 91.18.225.247:6881
type: 117.20.39.32:6881
type: 62.212.90.246:6881
type: 176.130.163.153:6881
type: 178.140.133.190:6881
type: 14.34.206.175:6881
type: 47.156.143.132:6881
type: 87.110.7.43:6881
type: 178.140.72.152:6881
type: 86.29.222.183:6881
type: 54.70.28.180:6881
type: 112.91.94.55:6881
type: 86.249.57.36:6881
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 45.203.212.18:6880
type: 45.203.155.73:6880
type: 195.154.233.74:6880
type: 45.203.207.46:6880
type: 45.203.154.86:6880
type: 45.203.205.61:6880
type: 69.164.203.179:6880
type: 18.189.151.174:6880
type: 114.34.138.206:51417
type: 178.162.174.43:28004
type: 178.162.174.228:28004
type: 45.152.210.34:50171
type: 193.23.249.178:50171
type: 216.39.248.235:51504
type: 37.48.111.172:49171
type: 69.50.95.40:10099
type: 162.251.63.120:10099
type: 185.149.91.171:51073
type: 130.239.18.158:8500
type: 130.239.18.158:8513
type: 178.162.173.194:28000
type: 37.48.111.189:50233
type: 130.239.18.158:8580
type: 45.131.79.44:64034
type: 195.154.185.217:27275
type: 95.168.168.32:30793
type: 195.154.185.217:27779
type: 195.154.172.179:27722
type: 37.59.205.219:49319
type: 212.102.53.47:47412
type: 106.158.99.241:19532
type: 91.122.34.149:51415
type: 23.162.56.83:12015
type: 109.236.91.11:6885
type: 114.241.102.232:51413
type: 93.51.18.111:51413
type: 109.195.103.111:51413
type: 135.181.139.47:51413
type: 5.135.155.133:51413
type: 176.188.10.36:51413
type: 50.116.12.85:51413
type: 107.181.136.199:51413
type: 144.172.124.252:51413
type: 123.113.12.58:51413
type: 118.223.30.162:51413
type: 195.154.164.243:51413
type: 24.93.16.161:51413
type: 24.193.154.170:6969
type: 195.201.179.130:16309
type: 203.96.226.45:32162
type: 130.239.18.158:8516
type: 178.162.173.91:28003
type: 178.162.174.227:28003
type: 178.162.174.106:28003
type: 207.65.186.45:6889
type: 221.188.35.74:6889
type: 37.204.7.116:6889
type: 77.235.218.241:6889
type: 87.229.17.52:6889
type: 219.98.6.76:6889
type: 58.161.15.144:6889
type: 178.33.233.79:8999
type: 37.48.118.83:8999
type: 51.7.166.89:8999
type: 45.136.230.247:8999
type: 172.96.121.2:6884
type: 185.107.71.103:44737
type: 178.162.174.77:28014
type: 5.79.80.223:28014
type: 178.162.174.228:28007
type: 178.162.173.144:28007
type: 178.162.174.102:28007
type: 212.7.202.40:28027
type: 185.203.56.38:31318
type: 82.14.161.197:21417
type: 23.162.56.55:10030
type: 172.111.38.128:26030
type: 188.65.212.147:21413
type: 51.75.77.134:8646
type: 216.39.248.235:51414
type: 185.162.8.29:64001
type: 47.83.133.255:8083
type: 213.130.92.0:38414
type: 162.251.63.120:10034
type: 212.24.99.108:8621
type: 176.212.185.6:53640
type: 185.203.56.1:16053
type: 178.162.174.77:28012
type: 178.162.173.194:28005
type: 178.162.174.226:28005
type: 178.162.173.89:28005
type: 178.162.173.172:28005
type: 37.27.119.182:50000
type: 37.27.119.247:50000
type: 159.69.143.182:50000
type: 188.129.83.180:12825
type: 188.165.200.90:56466
type: 37.48.95.144:22736
type: 178.162.173.163:28006
type: 178.162.173.26:28006
type: 37.48.70.3:28006
type: 51.159.104.76:7186
type: 185.149.91.13:51103
type: 185.149.91.185:51059
type: 89.10.239.29:56176
type: 89.149.207.208:21196
type: 51.38.81.212:8661
type: 178.162.173.212:28010
type: 24.7.226.248:58276
type: 146.71.73.51:63853
type: 178.162.173.222:28002
type: 59.15.80.63:56829
type: 45.87.250.167:51389
type: 119.247.227.148:13748
type: 207.90.194.62:6979
type: 109.111.109.244:52634
type: 176.63.6.45:19053
type: 95.27.43.71:2073
type: 62.210.115.125:34766
type: 213.130.93.57:3952
type: 178.252.83.188:37061
type: 78.173.40.26:41457
type: 37.59.61.117:50406
type: 86.31.2.69:63835
type: 185.21.216.194:57203
type: 176.63.22.160:6505
type: 136.169.149.234:30904
type: 134.41.200.79:56667
type: 118.237.209.253:21329
type: 193.32.23.166:62299
type: 190.46.28.244:2442
type: 47.225.32.20:65111
type: 67.0.87.137:40865
type: 57.129.45.79:8645
type: 5.3.238.4:44978
type: 181.41.70.185:45109
type: 37.45.137.96:27005
type: 179.5.68.55:48216
type: 71.201.92.231:6698
type: 113.153.16.164:49155
type: 168.119.13.211:46515
type: 83.104.53.251:47267
type: 79.130.122.77:14789
type: 188.165.198.14:54439
type: 143.244.52.44:55745
type: 90.23.202.132:9293
type: 179.61.197.203:58979
type: 223.132.54.207:11469
type: 152.53.45.107:7188
type: 168.119.13.211:33760
type: 217.132.128.189:49991
type: 1.176.25.15:43724
type: 138.204.208.157:33209
type: 73.12.52.252:54251
type: 185.44.147.97:27045
type: 78.142.231.133:6767
type: 95.216.96.160:27360
type: 35.171.49.86:6892
type: 202.61.194.107:32681
type: 162.55.243.114:2910
type: 66.70.178.54:5027
type: 189.203.90.69:41807
type: 195.170.172.38:10240
type: 152.53.45.107:7037
type: 194.207.133.91:34359
type: 189.224.27.236:46795
type: 5.2.72.169:12350
type: 107.189.8.87:60229
type: 103.140.3.2:31483
type: 5.9.11.185:56607
type: 5.79.85.89:64158
type: 51.159.104.60:8788
type: 94.75.194.218:28009
type: 169.150.223.194:62238
type: 23.158.56.119:10045
type: 161.0.155.236:40703
type: 219.79.148.193:11651
type: 175.198.215.84:27948
type: 162.251.63.78:12047
type: 172.111.38.128:26042
type: 95.214.53.172:1688
type: 172.90.83.244:38793
type: 218.253.136.196:10206
type: 54.77.218.23:6992
type: 192.114.71.40:49775
type: 169.197.143.248:53842
type: 37.48.95.195:45520
type: 144.172.94.163:29262
type: 95.168.168.210:48733
type: 77.21.255.25:7161
type: 152.53.45.107:6983
type: 168.119.13.211:28861
type: 85.103.111.151:32021
type: 185.149.91.133:51043
type: 37.59.205.219:49029
type: 5.79.77.94:22542
type: 187.183.48.233:1281
type: 31.181.248.70:18550
type: 5.248.129.252:12547
type: 118.211.244.161:42864
type: 185.203.56.12:18410
type: 123.48.243.234:15072
type: 219.85.85.55:14459
type: 47.152.149.151:51516

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/435293c4-7ea0-4b1b-93c7-1665641526c9

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/77b8934d3f2b8afe9d349d912f2e10d9d1fbbb2c4a963c82916895c93cb29875

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/77b8934d3f2b8afe9d349d912f2e10d9d1fbbb2c4a963c82916895c93cb29875/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-05-30 00:27:26 UTC

File Type:

ELF64 Little (Exe)

AV detection:

16 of 38 (42.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o64jgtj7fofp5hjutwis6lqq3hi7xozmjkldzaurnck4spfstb2q._file

Result

Malware family:

n/a

Score:

6/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250530-arwjva1jw9/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9d4c3bb2-2a64-4c49-9b98-a00d44e49961

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/77b8934d3f2b8afe9d349d912f2e10d9d1fbbb2c4a963c82916895c93cb29875

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	enterpriseunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise UNIX

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 77b8934d3f2b8afe9d349d912f2e10d9d1fbbb2c4a963c82916895c93cb29875

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3550686/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample