MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92dd346412e089530fd9bc30ab4de24392cf3070ea5680e1207fc341130ea04c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	92dd346412e089530fd9bc30ab4de24392cf3070ea5680e1207fc341130ea04c
SHA3-384 hash:	2b032023259efe25d880b7c60e4d8bfcea95fd9d77b48ba2c713758d4128131c283fbaa660d83b130f9634e9413fe6c1
SHA1 hash:	8a1b1a8c5eb2c629621e939d4a3c6ffbcaa117c3
MD5 hash:	312c247ffcff7a27e0262dc97872c0bf
humanhash:	earth-butter-saturn-connecticut
File name:	aarch64
Download:	download sample
File size:	509'896 bytes
First seen:	2025-06-16 10:59:42 UTC
Last seen:	2025-06-16 12:50:33 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP
TLSH	T102B41228EE4E3881F3D1E3B8DA0A4BB1B05B79D0D166C1B2BA41E25D95EDDDEC5D0212
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=684ff95207b5e8c1cfe6e320linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates directories

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

false

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

34387

Full report:

https://elfdigest.com/brief/92dd346412e089530fd9bc30ab4de24392cf3070ea5680e1207fc341130ea04c

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 178.69.209.93:6881
type: 85.215.59.222:6881
type: 37.119.68.168:6881
type: 63.247.211.162:6881
type: 82.3.77.67:6881
type: 86.29.68.192:6881
type: 89.187.196.177:6881
type: 212.69.44.241:6881
type: 87.250.213.217:6881
type: 92.22.96.224:6881
type: 188.255.79.164:6881
type: 94.180.173.76:6881
type: 62.46.141.194:6881
type: 46.72.128.191:6881
type: 62.235.203.147:6881
type: 18.223.137.220:6881
type: 90.64.40.158:6881
type: 61.165.184.30:6881
type: 194.12.89.13:6881
type: 54.194.124.68:6881
type: 184.22.165.23:6881
type: 35.163.251.58:6881
type: 18.218.241.3:6881
type: 148.135.106.206:6881
type: 18.188.31.0:6881
type: 75.119.138.164:6881
type: 67.220.72.41:6881
type: 157.50.186.141:6881
type: 139.162.168.10:6881
type: 35.155.156.153:6881
type: 167.99.72.189:6881
type: 86.148.189.236:6881
type: 54.194.137.170:6881
type: 88.116.104.130:6881
type: 1.158.158.62:6881
type: 135.181.227.244:50000
type: 135.181.238.57:50000
type: 37.27.103.179:50000
type: 65.21.128.248:50000
type: 65.21.128.229:50000
type: 37.27.117.252:50000
type: 37.27.117.58:50000
type: 37.27.107.114:50000
type: 37.27.119.241:50000
type: 37.27.103.181:50000
type: 65.21.128.213:50000
type: 65.21.129.44:50000
type: 65.21.125.188:50000
type: 65.108.102.46:50000
type: 37.27.103.241:50000
type: 65.109.115.71:50000
type: 65.21.33.212:50000
type: 175.171.101.54:50000
type: 153.227.40.153:50000
type: 65.21.34.43:50000
type: 37.27.120.61:50000
type: 178.162.174.222:28014
type: 130.239.18.158:8515
type: 178.162.174.43:28004
type: 130.239.18.158:8524
type: 178.162.174.143:28000
type: 178.162.174.138:28000
type: 178.162.174.178:28003
type: 178.162.174.169:28003
type: 176.212.21.138:51413
type: 84.217.73.58:51413
type: 213.158.1.85:51413
type: 45.154.86.160:51413
type: 220.57.45.108:51413
type: 185.56.20.113:51413
type: 24.151.40.233:51413
type: 164.132.175.155:51413
type: 5.196.66.146:51413
type: 120.7.30.248:51413
type: 39.110.137.73:51413
type: 94.140.5.151:51413
type: 45.154.86.136:51413
type: 95.165.129.77:51413
type: 163.172.222.28:51413
type: 172.96.121.2:6884
type: 112.87.174.182:6884
type: 178.162.174.46:28013
type: 178.162.174.45:28015
type: 178.162.173.153:28012
type: 31.210.173.50:27520
type: 130.239.18.158:8500
type: 46.232.210.175:29809
type: 45.91.208.117:52278
type: 45.56.122.13:6880
type: 100.24.111.119:6880
type: 45.203.155.80:6880
type: 52.21.231.83:6880
type: 95.211.136.213:57087
type: 89.149.202.17:28021
type: 5.9.41.13:53504
type: 115.39.77.134:17471
type: 37.48.118.89:28010
type: 178.162.174.34:28010
type: 89.149.204.83:62305
type: 72.21.17.23:24253
type: 37.48.108.37:28008
type: 82.172.167.161:6889
type: 1.158.89.66:6889
type: 85.126.153.66:6889
type: 60.250.97.151:6889
type: 89.149.202.17:28061
type: 217.12.150.142:60069
type: 185.203.56.51:11448
type: 118.232.109.123:30181
type: 175.110.115.46:6886
type: 185.203.56.42:15011
type: 98.206.149.41:10453
type: 95.24.109.209:15688
type: 51.89.195.183:20044
type: 188.165.200.53:57864
type: 185.203.56.53:25253
type: 202.184.159.36:50321
type: 14.47.77.186:20487
type: 82.149.23.125:34764
type: 46.63.250.38:26329
type: 211.194.236.86:64343
type: 119.205.152.150:40858
type: 46.232.210.171:58090
type: 78.168.85.75:37888
type: 5.194.236.48:42103
type: 222.108.176.29:40786
type: 119.193.179.64:40798
type: 176.114.184.74:3078
type: 169.150.243.3:12559
type: 95.24.21.250:53051
type: 142.105.51.216:33001
type: 178.162.173.172:28006
type: 74.71.30.8:12304
type: 130.239.18.158:8580
type: 220.135.73.194:34459
type: 172.92.116.76:61993
type: 189.18.54.82:43210
type: 1.41.11.220:61035
type: 46.232.210.118:64000
type: 128.0.104.15:8673
type: 190.172.72.63:6882
type: 94.23.215.83:6882
type: 190.62.87.135:20153
type: 24.100.111.114:55713
type: 211.34.39.189:7700
type: 162.55.243.114:1910
type: 161.142.153.66:23501
type: 95.214.53.172:1688
type: 178.162.174.170:28001
type: 93.92.87.200:12786
type: 222.238.137.4:41128
type: 188.19.172.222:1927
type: 54.38.92.16:64873
type: 195.170.172.38:10240
type: 146.59.3.81:10240
type: 152.53.52.107:10240
type: 152.53.104.128:10240
type: 152.53.45.107:6984
type: 78.142.231.133:6767
type: 176.31.183.98:63359
type: 54.36.168.18:46075
type: 47.89.251.173:7776
type: 213.159.77.154:11158
type: 5.29.16.141:40705
type: 51.75.78.69:6892
type: 178.162.144.51:21183
type: 88.184.202.2:34369
type: 143.58.205.28:55847
type: 2.79.110.143:47145
type: 46.232.210.157:64170
type: 103.252.201.50:9897
type: 58.177.102.129:14193
type: 31.15.138.119:63138
type: 86.138.135.235:54637
type: 178.150.51.236:47482
type: 31.208.22.160:42025
type: 78.174.75.231:37294
type: 188.233.8.150:8393
type: 5.79.85.89:64158
type: 217.18.216.56:20750

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/601e7e32-124e-4006-afcc-7a9c60086c9c

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/36979041-0360-4e90-963f-7e17bd477b84

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/92dd346412e089530fd9bc30ab4de24392cf3070ea5680e1207fc341130ea04c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/92dd346412e089530fd9bc30ab4de24392cf3070ea5680e1207fc341130ea04c/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2025-06-16 11:00:29 UTC

File Type:

ELF64 Little (Exe)

AV detection:

13 of 23 (56.52%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=slotizas4cevgd6zxqykwtpciojm6mdq5jlibyjap7buceyoubga._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250616-m37gpswqw6/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/07701b7c-9823-4ee8-b777-f5bf659fd39c

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/92dd346412e089530fd9bc30ab4de24392cf3070ea5680e1207fc341130ea04c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 92dd346412e089530fd9bc30ab4de24392cf3070ea5680e1207fc341130ea04c

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558161/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample