MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 933168973ff9e26e354cc9bdb4cb37b7ec4ef81947290b89bfc30a8929d2f56a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ladvix


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 933168973ff9e26e354cc9bdb4cb37b7ec4ef81947290b89bfc30a8929d2f56a
SHA3-384 hash: d90cabe37e6cb5e2bf4774da88c310f98302164fcb0082efc0a22661eed8d68bd80b77b40b104db6ebc8f1849e285b32
SHA1 hash: 0ebc47a3734f78deb01c3f774fb41d03952c5e3d
MD5 hash: 674e3db7d092f810efe91c3dd8ba26e0
humanhash: blossom-west-pip-nine
File name:xnxnxnxnxnxnxnxnaarch64xnxn
Download: download sample
Signature Ladvix
Create hunting rule
File size:78'843 bytes
First seen:2026-05-05 17:21:10 UTC
Last seen:2026-05-06 03:12:04 UTC
File type: elf
MIME type:application/x-sharedlib
ssdeep 1536:EASRdJ3VUQ0TcrWCT3gcHB+cyepg1k/zJhw7nWAvnQGUgJViXZjbZ3N2:7wJlp0T2WCbgc8bm/gCAv3JwpjbZ3N2
TLSH T1BA73029BB731AE3FCECCC7348896017865A9B1C0F36365213689969D664532EC71CFA3
telfhash t1c5b00217f7e0223066f9d9827666bf6dfc2a71c8f0b83875276ff6955600f9424e9004
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf Ladvix

Intelligence

File Origin
# of uploads :
2
# of downloads :
47
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0d88de71-c9c5-4b17-bb13-d1a02916d327/
Detection(s):
SecuriteInfo.com.Linux.Siggen.8335.6641.19878.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Sets a written file as executable
Creates or modifies files in /cron to set up autorun
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
packed rust upx
Link:
https://www.filescan.io/uploads/69fa273a2fcb905ec280d92a/reports/8a7a02c4-b4e8-4966-925e-52a16d7b0bc3/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
UPX
Botnet:
unknown
Number of open files:
14
Number of processes launched:
2
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/933168973ff9e26e354cc9bdb4cb37b7ec4ef81947290b89bfc30a8929d2f56a
Behaviour
Persistence
Information Gathering
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Malicious
File Type:
elf.64.le
First seen:
2026-05-05T14:35:00Z UTC
Last seen:
2026-05-05T18:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/933168973ff9e26e354cc9bdb4cb37b7ec4ef81947290b89bfc30a8929d2f56a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3210b3e7-2511-4929-848f-5f2ddc44a44d
Behavior Graph:
Download SVG
%3 guuid=75499d70-1800-0000-5c33-fafdaa0c0000 pid=3242 /usr/bin/sudo guuid=e8409a72-1800-0000-5c33-fafdae0c0000 pid=3246 /tmp/sample.bin delete-file write-file guuid=75499d70-1800-0000-5c33-fafdaa0c0000 pid=3242->guuid=e8409a72-1800-0000-5c33-fafdae0c0000 pid=3246 execve guuid=517c4ae0-1800-0000-5c33-fafdad0d0000 pid=3501 /tmp/sample.bin guuid=e8409a72-1800-0000-5c33-fafdae0c0000 pid=3246->guuid=517c4ae0-1800-0000-5c33-fafdad0d0000 pid=3501 clone
Malware family:
RHOMBUS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f2ddbccb-81a0-42e4-bcc5-9e360d8198d5
Result
Threat name:
Ladvix
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1908919
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample tries to persist itself using cron
Sample tries to set files in /etc globally writable
Writes identical ELF files to multiple locations
Yara detected Ladvix
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1908919 Sample: xnxnxnxnxnxnxnxnaarch64xnxn.elf Startdate: 05/05/2026 Architecture: LINUX Score: 80 77 daisy.ubuntu.com 2->77 97 Malicious sample detected (through community Yara rule) 2->97 99 Multi AV Scanner detection for submitted file 2->99 101 Yara detected Ladvix 2->101 103 Sample is packed with UPX 2->103 15 xnxnxnxnxnxnxnxnaarch64xnxn.elf 2->15         started        19 python3.8 dpkg 2->19         started        signatures3 process4 file5 75 /tmp/filep47QjL, ELF 15->75 dropped 79 Sample tries to set files in /etc globally writable 15->79 81 Writes identical ELF files to multiple locations 15->81 83 Sample tries to persist itself using cron 15->83 21 xnxnxnxnxnxnxnxnaarch64xnxn.elf filep47QjL 15->21         started        signatures6 process7 file8 61 /tmp/fileaa7wK8, ELF 21->61 dropped 105 Sample tries to set files in /etc globally writable 21->105 107 Writes identical ELF files to multiple locations 21->107 109 Sample tries to persist itself using cron 21->109 25 filep47QjL fileaa7wK8 21->25         started        signatures9 process10 file11 67 /tmp/filerndTXk, ELF 25->67 dropped 123 Sample tries to set files in /etc globally writable 25->123 125 Writes identical ELF files to multiple locations 25->125 127 Sample tries to persist itself using cron 25->127 29 fileaa7wK8 filerndTXk 25->29         started        signatures12 process13 file14 71 /tmp/fileUVazKi, ELF 29->71 dropped 135 Sample tries to set files in /etc globally writable 29->135 137 Writes identical ELF files to multiple locations 29->137 139 Sample tries to persist itself using cron 29->139 33 filerndTXk fileUVazKi 29->33         started        signatures15 process16 file17 57 /tmp/fileZZhZWy, ELF 33->57 dropped 85 Sample tries to set files in /etc globally writable 33->85 87 Writes identical ELF files to multiple locations 33->87 89 Sample tries to persist itself using cron 33->89 37 fileUVazKi fileZZhZWy 33->37         started        signatures18 process19 file20 63 /tmp/fileZHmO9U, ELF 37->63 dropped 111 Sample tries to set files in /etc globally writable 37->111 113 Writes identical ELF files to multiple locations 37->113 115 Sample tries to persist itself using cron 37->115 41 fileZZhZWy fileZHmO9U 37->41         started        signatures21 process22 file23 69 /tmp/filed3fR45, ELF 41->69 dropped 129 Sample tries to set files in /etc globally writable 41->129 131 Writes identical ELF files to multiple locations 41->131 133 Sample tries to persist itself using cron 41->133 45 fileZHmO9U filed3fR45 41->45         started        signatures24 process25 file26 73 /tmp/fileJBGbFL, ELF 45->73 dropped 141 Sample tries to set files in /etc globally writable 45->141 143 Writes identical ELF files to multiple locations 45->143 145 Sample tries to persist itself using cron 45->145 49 filed3fR45 fileJBGbFL 45->49         started        signatures27 process28 file29 59 /tmp/fileO2QEfX, ELF 49->59 dropped 91 Sample tries to set files in /etc globally writable 49->91 93 Writes identical ELF files to multiple locations 49->93 95 Sample tries to persist itself using cron 49->95 53 fileJBGbFL fileO2QEfX 49->53         started        signatures30 process31 file32 65 /tmp/fileiiyBJj, ELF 53->65 dropped 117 Sample tries to set files in /etc globally writable 53->117 119 Writes identical ELF files to multiple locations 53->119 121 Sample tries to persist itself using cron 53->121 signatures33
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/933168973ff9e26e354cc9bdb4cb37b7ec4ef81947290b89bfc30a8929d2f56a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/933168973ff9e26e354cc9bdb4cb37b7ec4ef81947290b89bfc30a8929d2f56a/
Verdict:
Malicious
Threat:
Family.LADVIX
Link:
https://tip.neiki.dev/file/933168973ff9e26e354cc9bdb4cb37b7ec4ef81947290b89bfc30a8929d2f56a
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-05 17:22:37 UTC
File Type:
ELF64 Little (SO)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=smywrfz77hrg4nkmzg63jszxw7we56azi4uqxcn7ymfiskos6vva._file
Result
Malware family:
ladvix
Create hunting rule
Score:
  10/10
Tags:
family:ladvix discovery execution infector linux persistence privilege_escalation trojan upx
Link:
https://tria.ge/reports/260505-vxdw7sct2z/
Behaviour
Reads runtime system information
Writes file to tmp directory
UPX packed file
Creates/modifies Cron job
Writes file to system bin folder
Executes dropped EXE
Family: Ladvix
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/933168973ff9e26e354cc9bdb4cb37b7ec4ef81947290b89bfc30a8929d2f56a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Trojan_Ladvix_db41f9d2
Create hunting rule
Author:Elastic Security
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Ladvix

sh f778e9f251fa6fa4fabdef19a275b16fa4576706f429f6308abce8a8a2fed126

Ladvix

elf 933168973ff9e26e354cc9bdb4cb37b7ec4ef81947290b89bfc30a8929d2f56a

(this sample)

  
Dropped by
SHA256 f778e9f251fa6fa4fabdef19a275b16fa4576706f429f6308abce8a8a2fed126
  
Dropped by
MD5 9d183242ee6050eb7f2d12699a736495
  
URLhaus
https://urlhaus.abuse.ch/url/3839740/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3839563/

Comments