MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94ea60ce05f0b6e6b0e2767c7b0ea3399c8f107a141e5178b56a2f2c6ea640a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments

SHA256 hash: 94ea60ce05f0b6e6b0e2767c7b0ea3399c8f107a141e5178b56a2f2c6ea640a0
SHA3-384 hash: e0f4c000ef728e545964bef3cabd4455f6e07c72fb89e3476aeea1942010f4e8fa98c6dc2a19771f1cc6af555c42fd29
SHA1 hash: aa3bc16a8184aa5c0c7631465eba21bce92dbbdf
MD5 hash: 62aa6394b782f7fc91d262c9fa8e1aa7
humanhash: lake-quiet-harry-white
File name:linux_ppc64
Download: download sample
File size:2'070'678 bytes
First seen:2025-08-11 23:42:47 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 49152:UbfIMWeDTyKn8Nrwtt56e3JLxKYzYR2iLHwOng/K5:MgMWeDTyK86t53txKSi21S5
TLSH T1E0A5D6D0B74C127CEE9F097685371E70A791668390F8C8BD870A895F02B09F7964FEA5
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence


File Origin
# of uploads :
1
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Status:
terminated
Behavior Graph:
%3 guuid=b298e6ce-1900-0000-3135-a2852d120000 pid=4653 /usr/bin/sudo guuid=aaaad0d0-1900-0000-3135-a28535120000 pid=4661 /tmp/sample.bin guuid=b298e6ce-1900-0000-3135-a2852d120000 pid=4653->guuid=aaaad0d0-1900-0000-3135-a28535120000 pid=4661 execve
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1754972 Sample: linux_ppc64.elf Startdate: 12/08/2025 Architecture: LINUX Score: 48 14 169.254.169.254, 80 USDOSUS Reserved 2->14 16 109.202.202.202, 80 INIT7CH Switzerland 2->16 18 4 other IPs or domains 2->18 20 Multi AV Scanner detection for submitted file 2->20 6 python3.8 dpkg 2->6         started        8 dash rm 2->8         started        10 dash rm 2->10         started        12 linux_ppc64.elf 2->12         started        signatures3 process4
Threat name:
Linux.Trojan.Multiverze
Status:
Malicious
First seen:
2025-08-11 23:43:37 UTC
File Type:
ELF64 Big (Exe)
AV detection:
10 of 38 (26.32%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 94ea60ce05f0b6e6b0e2767c7b0ea3399c8f107a141e5178b56a2f2c6ea640a0

(this sample)

  
Delivery method
Distributed via web download

Comments