MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80cc7413799dfad605c1591fd0f73f8080c17e0942c8d2a2c726da7ac6366183. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	80cc7413799dfad605c1591fd0f73f8080c17e0942c8d2a2c726da7ac6366183
SHA3-384 hash:	8388fddeeba676178f43542b1403a2b9812c14348f4259d407ec698520306e68696235658dbde371604c33a3fcfd5baa
SHA1 hash:	2a44c989c233dd738735c5589d1ebdb3a121f277
MD5 hash:	bc9c4c8c9eec4bf2f2460c4d4ba84fed
humanhash:	twenty-bravo-social-georgia
File name:	mips
Download:	download sample
File size:	592'688 bytes
First seen:	2025-07-02 10:36:36 UTC
Last seen:	2025-07-03 01:23:29 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zB:W7v+mrY2xzf03yvZ/YIh
TLSH	T15AC4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9
telfhash	t10ab0011070740bb84308e12d5cdcae5679f20cc3fe470c27db6047a159b54434d00d18
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68650be0c9eb974737655c00linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Receives data from a server

Locks files

Creates directories

Changes the time when the file was created, accessed, or modified

Opens a port

DNS request

Runs as daemon

Creating a file

Changes access rights for a written file

Sends data to a server

Creating a process from a recently created file

Connection attempt

Launching a process

Creates or modifies files in /cron to set up autorun

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

mips

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

40020

Full report:

https://elfdigest.com/brief/80cc7413799dfad605c1591fd0f73f8080c17e0942c8d2a2c726da7ac6366183

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 134.209.183.166:6881
type: 176.125.139.123:6881
type: 89.207.71.47:6881
type: 188.42.55.92:6881
type: 46.150.56.115:6881
type: 95.37.26.86:6881
type: 73.208.41.226:6881
type: 216.128.97.44:6881
type: 188.187.99.27:6881
type: 178.213.24.71:6881
type: 27.44.124.161:6881
type: 2.231.22.11:6881
type: 46.252.122.133:6881
type: 89.142.198.64:6881
type: 69.248.83.3:6881
type: 148.75.178.85:6881
type: 82.43.240.33:6881
type: 83.144.35.19:6881
type: 188.165.223.61:6881
type: 184.23.213.35:6881
type: 118.92.113.206:6881
type: 163.58.120.154:6881
type: 178.187.122.164:6881
type: 180.221.248.181:6881
type: 35.167.186.212:6881
type: 54.214.105.212:6881
type: 86.120.245.164:6881
type: 37.194.80.22:6881
type: 185.195.190.4:6881
type: 47.45.84.212:6881
type: 18.188.31.0:6881
type: 18.218.241.3:6881
type: 142.171.125.191:6881
type: 54.214.62.31:6881
type: 54.194.124.68:6881
type: 54.70.28.180:6881
type: 23.95.32.170:6881
type: 84.27.154.90:6881
type: 73.167.227.85:6881
type: 2.136.185.238:6881
type: 188.190.42.63:6881
type: 84.30.235.23:6881
type: 178.44.185.16:6881
type: 178.220.110.31:6881
type: 135.181.238.57:50000
type: 37.27.117.182:50000
type: 65.21.128.209:50000
type: 65.21.128.232:50000
type: 135.181.227.244:50000
type: 65.21.129.54:50000
type: 159.69.143.182:50000
type: 37.27.117.124:50000
type: 65.21.125.172:50000
type: 65.21.125.160:50000
type: 65.21.129.39:50000
type: 162.55.85.174:50000
type: 65.21.34.57:50000
type: 37.27.103.252:50000
type: 37.27.120.48:50000
type: 135.181.223.109:50000
type: 65.21.125.186:50000
type: 37.27.103.248:50000
type: 65.21.128.240:50000
type: 65.21.128.214:50000
type: 65.21.129.49:50000
type: 65.21.125.161:50000
type: 65.109.115.73:50000
type: 65.108.194.186:50000
type: 37.27.103.180:50000
type: 37.27.104.52:50000
type: 135.181.238.49:50000
type: 135.181.76.212:50000
type: 37.27.117.246:50000
type: 65.21.129.60:50000
type: 37.27.117.175:50000
type: 65.21.128.210:50000
type: 37.27.117.183:50000
type: 135.181.238.111:50000
type: 116.202.213.48:50000
type: 65.108.10.56:50000
type: 37.27.103.185:50000
type: 37.27.119.239:50000
type: 130.239.18.158:8515
type: 79.106.231.163:1434
type: 109.73.202.45:1434
type: 178.162.174.43:28004
type: 178.162.174.228:28004
type: 178.162.173.232:28004
type: 178.162.174.168:28004
type: 178.162.174.149:28001
type: 178.162.173.231:28001
type: 178.162.174.178:28001
type: 178.162.174.173:28016
type: 178.162.174.227:28003
type: 178.162.174.178:28003
type: 178.162.173.91:28003
type: 82.20.119.238:50014
type: 130.239.18.158:8539
type: 185.21.216.187:55928
type: 185.21.217.20:55446
type: 178.17.168.122:29090
type: 84.217.73.58:51413
type: 95.31.43.219:51413
type: 198.27.67.208:51413
type: 95.211.81.107:51413
type: 45.83.232.30:51413
type: 5.135.183.133:51413
type: 188.90.169.20:51413
type: 89.168.69.159:51413
type: 109.138.106.122:51413
type: 109.195.51.152:51413
type: 60.51.15.74:51413
type: 172.91.143.248:51413
type: 175.171.178.10:51413
type: 51.158.149.112:51413
type: 185.82.177.238:51413
type: 78.130.252.3:51413
type: 125.239.43.157:51413
type: 148.63.249.228:51413
type: 178.162.174.221:28000
type: 178.162.173.141:28000
type: 178.162.174.31:28000
type: 104.195.12.40:25829
type: 173.230.130.111:6880
type: 195.154.233.74:6880
type: 52.207.177.200:6880
type: 45.203.155.86:6880
type: 3.129.46.76:6880
type: 45.87.251.6:28045
type: 178.162.174.55:28007
type: 178.162.173.200:28007
type: 178.162.174.228:28007
type: 83.149.72.73:28007
type: 95.168.162.161:42670
type: 130.239.18.158:8580
type: 45.87.251.132:28207
type: 130.239.18.158:8516
type: 185.157.221.247:25401
type: 130.239.18.158:8513
type: 178.162.173.232:28011
type: 178.162.174.222:28011
type: 72.21.17.103:26370
type: 69.50.95.40:10085
type: 79.11.107.190:6889
type: 109.152.78.252:6889
type: 86.20.144.49:6889
type: 185.149.91.185:51059
type: 172.111.38.128:26039
type: 162.251.63.120:10038
type: 104.192.42.37:49842
type: 185.203.56.58:65365
type: 37.48.95.155:41729
type: 178.162.174.154:28009
type: 178.162.173.231:28009
type: 148.66.134.158:15973
type: 95.211.191.68:50784
type: 45.87.251.11:28127
type: 217.121.231.94:59625
type: 130.239.18.158:8508
type: 130.239.18.158:8521
type: 185.21.217.13:62329
type: 95.168.169.43:7954
type: 23.158.56.119:10021
type: 95.211.137.81:64117
type: 95.211.203.91:26022
type: 69.50.95.40:10000
type: 178.162.173.111:28008
type: 45.91.208.243:51936
type: 37.48.89.181:48531
type: 185.107.71.103:44737
type: 178.162.174.77:28014
type: 178.162.174.222:28014
type: 172.111.38.128:26084
type: 130.239.18.158:8524
type: 98.29.12.151:49393
type: 163.172.253.45:52822
type: 108.162.173.112:27189
type: 82.154.217.202:65534
type: 169.150.223.215:64085
type: 216.121.224.192:49001
type: 83.57.113.19:49001
type: 90.189.243.244:49001
type: 85.192.22.182:49001
type: 83.204.189.104:27032
type: 37.48.111.206:49944
type: 193.32.2.118:54058
type: 72.21.17.86:23644
type: 77.79.181.126:5785
type: 85.228.45.107:53652
type: 213.113.49.127:40365
type: 114.80.9.106:6882
type: 176.213.153.24:6882
type: 94.23.215.83:6882
type: 82.67.98.116:6882
type: 178.162.173.172:28010
type: 213.227.151.25:28006
type: 191.37.251.193:47528
type: 91.236.142.224:2498
type: 45.87.251.131:13196
type: 37.243.251.51:48308
type: 188.165.241.169:59691
type: 182.220.122.142:60245
type: 186.190.189.77:49735
type: 45.87.251.6:28020
type: 128.0.104.15:8680
type: 220.133.81.22:27214
type: 170.245.160.160:20581
type: 124.213.205.125:15894
type: 37.187.114.159:53779
type: 212.127.225.48:62979
type: 38.55.66.187:65000
type: 188.163.14.32:2043
type: 120.75.76.183:16714
type: 115.37.159.71:23128
type: 72.21.17.27:27408
type: 116.220.94.122:8296
type: 46.98.134.30:25066
type: 131.226.105.67:17657
type: 203.96.141.181:60026
type: 137.175.182.207:49533
type: 190.8.32.240:37153
type: 60.51.29.233:9332
type: 172.218.191.114:10127
type: 138.219.252.107:54138
type: 86.18.62.197:14083
type: 188.27.111.103:25390
type: 186.11.124.129:11466
type: 58.65.198.74:9636
type: 13.114.205.93:6892
type: 54.211.14.111:20872
type: 185.149.91.175:51008
type: 185.161.175.118:22611
type: 181.118.37.196:54545
type: 79.137.205.102:32000
type: 85.207.73.82:35782
type: 23.95.32.170:6969
type: 37.120.153.47:56660
type: 142.181.113.131:59264
type: 37.27.113.233:27724
type: 152.53.52.107:10240
type: 152.53.104.128:10240
type: 194.29.101.83:10240
type: 195.170.172.38:10240
type: 5.79.67.28:41750
type: 78.142.231.133:6767
type: 95.214.53.172:1688
type: 137.74.95.127:27058
type: 51.75.78.69:6884
type: 5.135.138.99:8574
type: 5.135.138.216:57642
type: 54.77.218.23:6992
type: 57.129.4.81:36112
type: 46.232.211.231:58092
type: 37.48.89.217:4281
type: 87.229.85.53:59321
type: 128.65.38.156:49867
type: 185.149.91.177:51025
type: 94.23.214.170:31975
type: 93.104.215.51:15937
type: 72.21.17.26:29528
type: 188.165.246.140:51672
type: 94.130.135.227:64422
type: 88.161.191.77:14413
type: 184.155.122.97:37431
type: 170.233.5.49:21571
type: 176.111.180.54:28627
type: 130.239.18.158:8543
type: 1.120.172.221:15332
type: 46.232.211.70:24009
type: 78.87.145.110:55055

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7355d9a9-d6a0-41ba-aac9-8af02c99d56f

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d90a86b3-670d-40b5-a6b6-97ab19214f8d

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/80cc7413799dfad605c1591fd0f73f8080c17e0942c8d2a2c726da7ac6366183

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/80cc7413799dfad605c1591fd0f73f8080c17e0942c8d2a2c726da7ac6366183/

Threat name:

Linux.Dropper.Multiverze

Status:

Malicious

First seen:

2025-07-02 10:37:19 UTC

File Type:

ELF32 Big (Exe)

AV detection:

18 of 38 (47.37%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qdghie3ztx5nmboblep5b5z7qcamc7qjilenfiwhe3nhvrrwmgbq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250702-mnwrnavyf1/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/7464b3c9-fc1c-4556-9b6a-ebad2f17394b

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/80cc7413799dfad605c1591fd0f73f8080c17e0942c8d2a2c726da7ac6366183

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 80cc7413799dfad605c1591fd0f73f8080c17e0942c8d2a2c726da7ac6366183

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558223/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample